The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to shell out sub-tasks to various command-line interfaces (CLIs) like ollama, gemini, codex, and hermes. The instructions use simple string interpolation ("<prompt>") to pass user input into these shell commands. This pattern is vulnerable to command injection if the input contains shell metacharacters such as backticks, semicolons, or subshell syntax (e.g., $(command)). Evidence in SKILL.md includes commands like ollama run qwen2.5-coder:7b "<prompt>", gemini -p "<prompt>", codex exec --full-auto "<prompt>", and hermes -z "<prompt>".
[CREDENTIALS_UNSAFE]: The skill includes a detection script that checks for the presence of multiple AI provider API keys in the environment. It also explicitly references a specific local file path, ~/.config/jack-keys.env, as a source for these keys. While checking for environment variables is a common practice, hardcoding references to specific local credential files increases the attack surface for sensitive data discovery. Evidence in SKILL.md: [ -f ~/.config/jack-keys.env ] && echo " (also source ~/.config/jack-keys.env for stored keys)".
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted user tasks and passes them to external model providers or local CLIs without using boundary markers or sanitization.
Ingestion points: The <prompt> variable in SKILL.md delegation commands.
Boundary markers: Absent; user input is enclosed in double quotes within shell commands but not delimited for the target AI model.
Capability inventory: The skill has the capability to execute shell commands and perform network requests to various AI providers.
Sanitization: No sanitization or filtering of the user-provided prompt is performed before execution.

route