The Agent Skills Directory

[COMMAND_EXECUTION]: The workflow instructions in SKILL.md and references/exhaustive-workflow.md require the agent to execute the references/detect.sh script using a user-supplied {scope} variable as a command-line argument. The instructions fail to specify any sanitization or validation requirements for this input. This enables a command injection attack where a user can provide a value containing shell metacharacters (e.g., ; malicious_command) to execute arbitrary code in the agent's environment.
[COMMAND_EXECUTION]: The provided references/detect.sh script contains an option injection vulnerability. Filenames retrieved from the repository using git ls-files are passed to grep and check_content without using the -- end-of-options marker. An attacker could place files with names starting with hyphens (e.g., -V) in the repository to manipulate the detection script's behavior or cause execution errors.
[INDIRECT_PROMPT_INJECTION]: The skill's reconnaissance phase relies on scanning repository files and manifests using references/detect.sh. The output of this script is then used by the agent to determine which subsequent audit lanes to dispatch. Maliciously crafted filenames or manifest entries (like keys in package.json) could potentially influence agent behavior or workflow decisions if not properly handled during output interpretation. Evidence of ingestion surface:
Ingestion points: references/detect.sh reads manifest files (package.json, Cargo.toml, requirements.txt, etc.) and file listings from the repository.
Boundary markers: None identified between repository data and detection logic.
Capability inventory: The skill dispatches workers with file-read, network, and subprocess capabilities to perform the audit waves.
Sanitization: Missing sanitization for manifest keys and filenames before they are processed by the detection logic or agent context.

repo-audit