The Agent Skills Directory

[COMMAND_EXECUTION]: The shell script logic in SKILL.md is vulnerable to command injection. The $ARGUMENTS variable, which contains user-supplied input, is interpolated directly into shell command strings (e.g., echo "$ARGUMENTS"). An attacker providing input containing shell metacharacters (such as ;, `, or $(...)) can execute arbitrary commands in the agent's environment. Specifically, the line ISSUE_FILE=$(echo "$ARGUMENTS" | sed 's/^--issue //') is a primary injection vector.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from local markdown files in the .planning/issues/open/ directory. These files are parsed to extract title and provenance metadata. If these files are populated from external sources like GitHub issues or pull requests, an attacker can embed malicious shell sequences or instructions. The use of grep, cut, and xargs on this extracted data without rigorous sanitization allows malicious content to propagate into the project's planning documents and potentially trigger command execution during parsing.
[INDIRECT_PROMPT_INJECTION] Evidence Chain:
Ingestion points: The skill reads file paths provided via the --issue flag, specifically targeting .planning/issues/open/*.md files.
Boundary markers: None are present. The skill assumes the issue file content is safe and strictly follows a key-value structure.
Capability inventory: The skill possesses the ability to create directories (mkdir), write to critical project files (ROADMAP.md, STATE.md), and execute shell commands (grep, sed, node, printf).
Sanitization: While the slug variable is sanitized using tr and sed, the initial extraction of ISSUE_FILE and description from the user-provided arguments and file content is not protected against shell injection.

kata-add-phase