The Agent Skills Directory

[COMMAND_EXECUTION]: In SKILL.md (Step 2f), the orchestrator executes a shell script by passing a summary string obtained from a sub-agent: "${SHIP_PLUGIN_ROOT}/scripts/auto-orchestrate.sh" complete --verdict= --summary=''. If the agent's summary contains single quotes or other shell metacharacters, it can lead to arbitrary command execution on the host system.
[COMMAND_EXECUTION]: In SKILL.md (Step 1), the orchestrator initializes a task using the user-provided description: "$SHIP_ORCH" init ''. This is vulnerable to command injection if the user input contains single quotes and shell commands.
[PROMPT_INJECTION]: In prompts/design.md.tmpl, the {{DESCRIPTION}} variable is directly interpolated into the planning request without sanitization or boundary markers (such as XML-style delimiters), making it vulnerable to direct prompt injection.
[REMOTE_CODE_EXECUTION]: The dev.md.tmpl and e2e.md.tmpl prompts instruct the agent to run the repository's own build, test, and lint commands. While necessary for functionality, this represents a significant execution surface for any malicious code present in the target repository.
[PROMPT_INJECTION]: The skill contains an indirect prompt injection surface. 1. Ingestion points: prompts/design.md.tmpl (user description) and prompts/dev-fix.md.tmpl (findings from sub-agents). 2. Boundary markers: Absent in all prompt templates. 3. Capability inventory: Access to Bash and the Agent tool. 4. Sanitization: No sanitization is performed on user or agent-provided strings before they are used in shell commands or prompt templates.

auto