The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill uses an LLM to generate 'setup_commands' for test scenarios, which are then executed via subprocess.run in scripts/runner.py. Because the commands are generated based on the content of external skill files, a malicious file could influence the LLM to output harmful shell commands which the skill would execute without validation.
[COMMAND_EXECUTION]: The skill programmatically constructs and executes shell commands using subprocess.run in several scripts (runner.py, classifier.py, scenario_generator.py, spec_generator.py) to interface with the claude CLI and manage sandboxed environments. This broad use of subprocess execution increases the overall attack surface.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external Markdown files to derive behavioral specifications and test scenarios, creating a significant injection surface.
Ingestion points: User-provided skill or rule file path processed in scripts/run.py and subsequently read in scripts/spec_generator.py and scripts/scenario_generator.py.
Boundary markers: Prompts use triple-dash (---) separators around ingested content but lack explicit instructions for the LLM to ignore potentially malicious directions within that content.
Capability inventory: Ability to execute arbitrary shell commands via subprocess.run and invoke the claude CLI with generated prompts.
Sanitization: Implements path sanitization in _safe_sandbox_dir to restrict file operations to a temporary directory, but lacks content sanitization for the generated commands and prompts produced by the LLM.

skill-comply