The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/fix.mjs executes external shell commands using execSync without properly sanitizing its inputs.
The repo variable, which is a command-line argument, is directly interpolated into a ripgrep shell command: execSync(rg -l --no-messages "@howells/lint-policy-v\d" ${repo} ...).
The script performs a git mv operation where the repo path and file variables from and to (derived from the filesystem) are interpolated directly into the command string: execSync(git -C ${repo} mv "${from}" "${to}").
The lack of shell escaping or the use of an argument array (e.g., via spawnSync) makes these calls susceptible to command injection if paths or filenames contain shell-sensitive characters like semicolons or backticks.
[INDIRECT_PROMPT_INJECTION]: The skill's scripts process untrusted repository content (filenames and package metadata) which directly influences the parameters passed to high-privilege operations.
Ingestion points: The walk function in scripts/fix.mjs identifies directories using readdirSync, and the script reads package.json contents using readFileSync to identify dependencies.
Boundary markers: None. The script does not validate that filenames or repository paths adhere to safe naming conventions before passing them to the shell.
Capability inventory: The skill has the ability to execute shell commands (execSync), write to the filesystem (writeFileSync), and delete files (unlinkSync).
Sanitization: Absent. No shell escaping or input validation is performed on the strings derived from the repository structure.

howells-lint