The Agent Skills Directory

Dynamic Command Execution from Input Data: The skill executes shell commands (run_command and reattack_run_command) retrieved from finding JSON files located in the workspace/findings/ directory. This pattern allows the agent to run arbitrary logic defined in external data, which could be exploited if an attacker can manipulate these files to include malicious commands.
Dynamic Script Generation and Execution: During operation, the skill generates a Python helper script (workspace/helpers/append_patch.py) and executes it to update finding metadata. Dynamically creating and running executable code is a potential risk as it can be used to perform actions that are not visible during static analysis of the skill's source files.
Indirect Prompt Injection Surface: The skill processes untrusted data from finding files which dictates code paths and execution parameters. Without strict validation or sanitization of this input, it presents an attack surface where malicious instructions could be embedded to influence the agent's behavior during the patching lifecycle, such as diverting the patch process or compromising the isolation environment.

mantis-patch