The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: Step B5 in SKILL.md contains a shell script snippet for constructing a GitHub issue body. It uses an unquoted heredoc (cat > .claude/state/issue-body.md <<EOF). The instruction directs the agent to interpolate content directly from an untrusted bug report file (e.g., 'First paragraph of the bug description') into this block. Because the heredoc is unquoted, any shell command substitution patterns like $(...) or `...` present in the bug report will be executed by the shell during the file creation process.
[INDIRECT_PROMPT_INJECTION]: This skill presents a significant attack surface by processing external, untrusted data and using it in sensitive shell operations.
Ingestion points: SKILL.md (Step B1) and references/bug-doc.js read and parse external bug report markdown files specified by BUG_FILE_PATH.
Boundary markers: No boundary markers or escaping logic are present in the shell command construction to separate trusted instructions from untrusted data content.
Capability inventory: The skill executes multiple subprocesses (cat, node, gh) and performs file system writes and network requests using data derived from the input file.
Sanitization: No sanitization or shell-escaping is performed on the descriptive text (Summary, Reproduction steps, Impact) before it is interpolated into the shell heredoc in Step B5.
[COMMAND_EXECUTION]: The skill heavily relies on executing shell commands through the gh CLI and local scripts. While these tools are standard for the task, the implementation pattern in the main instructions creates a direct path for arbitrary command execution due to the lack of proper input handling.

ensure-bug-github-issue