The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/client-comms.ts contains a shell command injection vulnerability in the generateClientChangelog function. The code uses execSync to execute a git log command where the ref parameter is taken directly from command-line arguments. Although there is a check to ensure the argument does not start with a hyphen, it does not sanitize shell metacharacters like ;, &, or |, allowing an attacker to execute arbitrary system commands.
[INDIRECT_PROMPT_INJECTION]: The skill's intake process for client feedback, described in references/feedback.md and implemented in scripts/client-comms.ts, handles raw external data from emails and chat threads. This creates a surface where malicious instructions embedded in client feedback could influence the agent's behavior. The agent possesses broad capabilities including bash and file modification, and while 'Anti-Drift Boundaries' are mentioned, they do not provide a robust security barrier against adversarial prompts. Ingestion points include the translateClientFeedback function and the feedback intake procedure.
[CREDENTIALS_UNSAFE]: The project handover protocol in references/handover.md instructs the agent to 'log every item transferred' when managing sensitive credentials such as hosting, CMS, and app store logins. Recording these items in a persistent transfer log increases the risk of credential exposure if the logs are not strictly protected or are accidentally shared.

client-comms