The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on the execution of shell scripts located in the user's home directory (e.g., $HOME/.claude/scripts/codex-research.sh and verify-research.sh). These external dependencies are not included in the skill package, which creates a risk if the scripts are missing, malicious, or have insecure permissions.
[COMMAND_EXECUTION]: Step 2.4a contains a potential command injection vulnerability. The skill instructs the agent to interpolate the user's original query into a shell command: bash "$CODEX_HELPER" ... "Research the query '<ORIGINAL QUERY>'...". If the user-supplied query contains single quotes or other shell metacharacters (e.g., '; rm -rf /; '), it could lead to arbitrary code execution on the host machine.
[PROMPT_INJECTION]: The skill demonstrates an indirect prompt injection attack surface. It ingests data from multiple external search providers (Tavily, Exa, and Perplexity) and passes this untrusted content to a 'Critic Agent' and 'Codex' sub-agents. The instructions lack explicit boundary markers or sanitization steps to ensure that malicious instructions embedded in web search results do not hijack the sub-agents' behavior.
[PROMPT_INJECTION]: Evidence Chain for Indirect Injection:
Ingestion points: External search results from Tavily, Exa (Step 2.2), and Perplexity (Step 2.4) entering the context in SKILL.md.
Boundary markers: Absent. The data is processed as raw text within the reports and sub-agent prompts.
Capability inventory: File system writes (Write tool), shell command execution (bash in Step 2.4a and 2.9), and sub-agent invocation (Agent tool).
Sanitization: Absent. There is no evidence of escaping or filtering content from search results before it is used in synthesis or shell commands.

expert-research