The Agent Skills Directory

[COMMAND_EXECUTION]: The usage instructions in SKILL.md recommend a pattern for command execution that is highly susceptible to command injection. By instructing the agent to wrap the <user prompt> placeholder in double quotes within a shell command (e.g., python3 ... --prompt "<user prompt>"), a malicious user can provide a prompt that escapes the quotes (e.g., "; [malicious_command]; ") to execute arbitrary code on the host system.
[DATA_EXFILTRATION]: The scripts/match_skills.py script contains a path traversal vulnerability. The --prompt-file argument directly takes a user-supplied path and reads its content using Path(args.prompt_file).read_text() without any validation or sandboxing. This allows an attacker to read sensitive files (e.g., ~/.ssh/id_rsa, .env files) and have their contents processed and potentially exposed by the agent.
[DATA_EXFILTRATION]: The skill uses hardcoded absolute paths containing a specific local username (mm-macbookpro) in both SKILL.md and scripts/match_skills.py. This leaks information about the author's local environment and will cause the skill to fail on any system with a different user structure.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it aggregates metadata from external SKILL.md files in the library.
Ingestion points: Metadata (name and description) is read from all SKILL.md files located in ~/.codex/skills/ (line 108 of match_skills.py).
Boundary markers: The skill does not use delimiters or protective instructions when presenting these descriptions back to the agent in its output.
Capability inventory: The skill facilitates system-level shell execution and arbitrary file reading.
Sanitization: There is no filtering or sanitization of the content extracted from the external skill files, allowing a malicious skill description to hijack the agent's behavior.

prompt-oracle