The Agent Skills Directory

[COMMAND_EXECUTION]: The instructions in SKILL.md and the workflows/ directory recommend executing Node.js scripts by passing the user's raw query directly into shell commands, for example: node scripts/detect-topic.js "<user query>". This creates a significant risk of shell command injection. If the agent does not properly escape the user's input, an attacker could use shell metacharacters (e.g., ;, &, |, `) to execute arbitrary commands on the system.
[PROMPT_INJECTION]: The skill implements an indirect prompt injection surface by fetching and processing external llms.txt documentation files from the web (via context7.com or search results). A malicious documentation file could contain instructions designed to manipulate the agent's subsequent logic or data processing.
Ingestion points: External documentation content is fetched in scripts/fetch-docs.js and passed to the agent or scripts/analyze-llms-txt.js for interpretation.
Boundary markers: None identified. The skill does not instruct the agent to use delimiters or ignore embedded instructions when reading fetched documentation.
Capability inventory: The skill has the capability to execute shell commands (via agent instructions), perform network requests (https.get in scripts/fetch-docs.js), and access local environment variables (scripts/utils/env-loader.js).
Sanitization: There is no evidence of content validation or sanitization for the fetched documentation content before it is processed.
[EXTERNAL_DOWNLOADS]: The workflows/repo-analysis.md file encourages the agent to clone arbitrary third-party repositories (git clone) and suggests the global installation of external software (npm install -g repomix). These operations involve downloading and running code from external, untrusted sources, which introduces supply chain and execution risks.

docs-seeker