The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/anti-drift.ts utility uses execSync to run git diff with a sinceRef parameter directly sourced from command-line arguments without sanitization. An attacker providing a malicious reference string could execute arbitrary shell commands on the host system.
[DATA_EXFILTRATION]: The verifyDeployUrl function in scripts/anti-drift.ts performs network requests using fetch to arbitrary URLs provided via the --verify-deploy command-line argument. This can be abused for Server-Side Request Forgery (SSRF) or to exfiltrate sensitive information to external servers.
[INDIRECT_PROMPT_INJECTION]: The skill implements a multi-agent refinement loop that ingests and processes untrusted code from the workspace, creating an attack surface. 1. Ingestion points: Project files are read by the Builder and Fresh Critic agents, and by the anti-drift.ts script for audits. 2. Boundary markers: The instructions do not specify any markers or delimiters to separate untrusted code from agent instructions. 3. Capability inventory: The skill has access to powerful tools including bash, run_command, and write_to_file, allowing it to modify the file system and execute shell commands. 4. Sanitization: No sanitization or filtering is performed on the ingested code before it is processed by the agents.

gauntlet-loop