The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the user-provided $CATALOG_URL variable directly in shell commands like curl, printf, and gh. This pattern creates an injection surface if the agent does not strictly sanitize the input before execution.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface (Category 8):
Ingestion points: The $CATALOG_URL parameter and the JSON content retrieved from that URL in SKILL.md.
Boundary markers: No explicit delimiters or instructions are used to isolate the untrusted catalog content from the agent's control logic.
Capability inventory: The skill possesses capabilities for network operations (curl), file system writes (printf > catalogs/), and GitHub repository interactions (gh).
Sanitization: The Python validation script performs a basic check for the 'type' field but does not sanitize the 'id' or 'title' fields before they are output or used in the PR description.
[DATA_EXFILTRATION]: The use of curl to fetch arbitrary user-provided URLs allows the agent to interact with external endpoints, which could be leveraged to transmit data if the URL is maliciously constructed.

register-catalog