The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands (e.g., node src/cli.mjs verify) in SKILL.md that incorporate user-supplied input via the $ARGUMENTS variable. This introduces a risk of command injection if the input contains shell metacharacters and is not properly escaped by the agent, despite instructions to treat the input as a literal path and use quoting.\n- [INDIRECT_PROMPT_INJECTION]: The skill provides an attack surface by ingesting untrusted data through the $ARGUMENTS variable in SKILL.md and using it to drive agent actions and tool calls.\n
Ingestion points: User input passed via $ARGUMENTS in SKILL.md.\n
Boundary markers: The skill includes explicit instructions in SKILL.md for the agent to validate input: "Ask for confirmation rather than executing a value that cannot be represented safely as one path" and "Do not evaluate it as a shell expression."\n
Capability inventory: The skill allows access to Bash (limited to specific commands like npm test, git rev-parse, and node) and Read tools as defined in the allowed-tools metadata of SKILL.md.\n
Sanitization: The instructions require the agent to quote the resolved path, but there is no automated sanitization or programmatic filtering logic provided within the skill.

verify-release