The Agent Skills Directory

[COMMAND_EXECUTION]: The instructions in SKILL.md and references/rule-name-resolution.md direct the agent to execute shell commands that interpolate unvalidated user keywords directly into a grep command (e.g., sf code-analyzer rules --rule-selector all 2>&1 | grep -i "<USER_KEYWORD>"). This pattern allows a malicious user to execute arbitrary commands by providing input containing shell metacharacters.
[REMOTE_CODE_EXECUTION]: The references/engine-prerequisites.md file contains instructions to fetch and execute scripts from external sources such as SDKMAN, NVM, and NodeSource using piping to shell interpreters (e.g., curl | bash).
[PRIVILEGE_ESCALATION]: The skill recommends using sudo for installing global npm packages, system-level dependencies, and modifying file system permissions in references/troubleshooting.md and references/engine-prerequisites.md.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-provided strings and local project configuration files (code-analyzer.yml) to perform rule name resolution and validation. There is a lack of explicit sanitization or boundary markers when this untrusted data is interpolated into shell commands or parsed by internal scripts.
Ingestion points: User keywords for rule lookup; contents of code-analyzer.yml and sfdx-project.json files.
Boundary markers: None identified for user keywords used in shell commands.
Capability inventory: Ability to execute sf, grep, python3, npm, and java commands; ability to write and edit files at the project root.
Sanitization: No sanitization or escaping is performed on user keywords before shell interpolation.

dx-code-analyzer-configure