The Agent Skills Directory

[COMMAND_EXECUTION]: The procedure in SKILL.md directs the agent to execute a local script scripts/validate-metadata.py using shell command interpolation: python3 scripts/validate-metadata.py --name "[name]" --description "[description]". If the agent platform does not sanitize the user-provided name or description strings, an attacker could potentially execute arbitrary commands by including shell metacharacters (e.g., ;, &&, |, or backticks) in the metadata fields.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data (user-defined skill metadata) and pass it to a tool capability. The instructions lack explicit sanitization or boundary markers for this untrusted input before it reaches the command line.
Ingestion points: Metadata placeholders [name] and [description] used in Step 1 of SKILL.md.
Boundary markers: None identified in the command execution pattern.
Capability inventory: Subprocess execution of local Python scripts via the shell.
Sanitization: The logic intended for validation and sanitization within scripts/validate-metadata.py is truncated and incomplete, meaning the script will not perform the checks necessary to secure the input.

skill-creator