The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's instructions execute shell commands that incorporate the $ARGUMENTS variable directly, such as uv run python3 $CLAUDE_PROJECT_DIR/tools/response_tracker.py log $ARGUMENTS. This enables command injection, allowing an attacker to execute arbitrary shell commands by supplying input containing characters like ;, &, or |.
[DATA_EXFILTRATION]: The command uv run python3 $CLAUDE_PROJECT_DIR/tools/global_brain.py sync-from-local indicates that the skill synchronizes locally stored data to an external repository. Given the skill's purpose of tracking vulnerability reports and platform responses, this poses a risk of leaking sensitive bug hunting data to a remote server.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted data from platform responses.
Ingestion points: Untrusted data from platform responses enters the agent context via the $ARGUMENTS variable in SKILL.md.
Boundary markers: There are no delimiters or instructions to ignore embedded commands within the processed data.
Capability inventory: The skill can execute shell commands via uv run python3 across multiple scripts and performs network-based synchronization.
Sanitization: No sanitization or validation of the input is performed before it is logged to the 'brain' or used in commands.

learn