The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute a shell command using a file path derived from user input ($ARGUMENTS). The command template python3 ${CLAUDE_PLUGIN_ROOT}/skills/create-agent/scripts/validate_agent.py <agent-file> --output json uses direct string interpolation of the target file path. This creates a risk of shell command injection if the user provides a path containing shell metacharacters (e.g., ;, &&, or |) instead of a legitimate filename.
[INDIRECT_PROMPT_INJECTION]: The skill loads the content of an untrusted agent file into the context using the @$ARGUMENTS directive for the purpose of auditing it. This ingestion happens without the use of boundary markers (delimiters) or specific instructions to the model to ignore any embedded prompts or instructions within the loaded file. This creates an attack surface where a malicious agent file could contain instructions designed to override the repair-agent's logic or influence its behavior.
Ingestion points: The @$ARGUMENTS inclusion in Phase 1 of SKILL.md.
Boundary markers: None present around the ingested content.
Capability inventory: The skill has access to file reading and shell command execution (via the validation step in Phase 4).
Sanitization: No sanitization or escaping of the ingested agent file content is performed prior to the audit process.

repair-agent