The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the agent to generate a shell script (sync-reference-repos.sh) that incorporates user-supplied strings for repository names and URLs. These values are placed inside double quotes within a bash function call (sync_repo "<name>" "<clone-url>"). Because the skill does not mandate sanitization of these inputs, a malicious URL containing shell metacharacters (such as backticks or $()) could lead to arbitrary command execution when the script is run in Step 4 or via the project's bootstrap.
[REMOTE_CODE_EXECUTION]: The skill wires the synchronization script into the project's tracked lifecycle, including bootstrap.sh, devcontainer configurations, and Husky git hooks. This integration ensures that the script (and any injected commands) executes automatically during project setup or version control events, facilitating persistent execution of untrusted code if the source URL is malicious.
[INDIRECT_PROMPT_INJECTION]: The skill provides a surface for indirect prompt injection by processing untrusted repository URLs and metadata into executable configurations.
Ingestion points: The <repository URL> and use-case descriptions are ingested via the skill's primary argument hint in SKILL.md.
Boundary markers: No boundary markers or "ignore" instructions are specified for the interpolation of the URL or name into the shell script or documentation files.
Capability inventory: The skill has the capability to write executable files, modify existing project scripts (bootstrap.sh), update version control configurations (.gitignore), and execute shell commands (git, bash).
Sanitization: There is no mention of sanitizing, validating, or escaping the external URL input before it is used to generate the synchronization script.

reference-repos