The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/generate_plan.sh is vulnerable to command injection within its prompt_input function. It uses the eval command (e.g., eval "$var_name=\"$input\"") to process user input received via the read command without any sanitization or validation. This allows an attacker to execute arbitrary shell commands by providing input containing metacharacters such as backticks, semicolons, or dollar-sign parentheses.
[DYNAMIC_EXECUTION]: The use of eval in scripts/generate_plan.sh to dynamically handle variable assignments from user-controlled strings constitutes a significant security risk for dynamic execution.
[COMMAND_EXECUTION]: The script scripts/position_calculator.sh is vulnerable to command injection through unsafe shell expansion. User-provided values like ACCOUNT_SIZE and RISK_PERCENT are interpolated directly into shell command strings (e.g., echo "... $ACCOUNT_SIZE ..." | bc). If these inputs contain command substitution patterns, they will be executed by the shell during the evaluation of the pipe.

trading-plan-generator