The Agent Skills Directory

[COMMAND_EXECUTION]: The skill defines pre and post lifecycle hooks in the YAML frontmatter that execute shell commands on the host environment.
[COMMAND_EXECUTION]: The pre hook contains a command injection vulnerability. The variable $TASK is interpolated directly into the shell string echo "🗳️ Raft Manager starting: $TASK" and the conditional block if [[ "$TASK" == *"election"* ]]. If the content of $TASK is influenced by untrusted user input and not sanitized by the execution platform, an attacker could execute arbitrary code using shell metacharacters or command substitution (e.g., $(whoami) or ; rm -rf /).

agent-raft-manager