The Agent Skills Directory

[COMMAND_EXECUTION]: The slash command orchestrator in assets/clone-website.md uses the user-provided URL ($ARGUMENTS) inside a double-quoted string in a bash context: DOMAIN=$(echo "$ARGUMENTS" | ...). This configuration is vulnerable to command injection, as the shell will expand and execute any command substitutions (e.g., $(command)) contained within the user input.
[PRIVILEGE_ESCALATION]: The command injection vulnerability in the orchestrator script allows for the execution of arbitrary commands within the agent's shell environment, leading to unauthorized system access or modification.
[INDIRECT_PROMPT_INJECTION]: The skill implements a multi-agent workflow that ingests content from external websites and processes it through specialized agents (website-cloner, website-qa-reviewer). The workflow does not utilize boundary markers or specific instructions to ignore embedded prompts in the scraped data, creating a surface for indirect prompt injection attacks.
Ingestion points: External website content is fetched via Playwright in Phase 1 and Phase 2, then stored in .tasks/clone-{domain}/context.md.
Boundary markers: Absent. The sub-agent prompts in references/subagents.md do not include delimiters or warnings to treat ingested content as untrusted data.
Capability inventory: Sub-agents are granted Bash, Write, Read, and Edit permissions in references/subagents.md, providing a significant impact surface if the agents are manipulated by external content.
Sanitization: No sanitization or filtering logic is present to clean the data extracted from target websites before it is used by the cloner agent to generate code.

website-cloner