The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted Markdown files using an LLM to generate behavioral specifications and test scenarios, creating an attack surface for embedded instructions to hijack the tool. (1) Ingestion points: scripts/run.py via the skill argument. (2) Boundary markers: The prompt templates in prompts/spec_generator.md and prompts/scenario_generator.md use basic delimiters (---) but lack explicit instructions to disregard nested instructions. (3) Capability inventory: scripts/runner.py executes shell commands via subprocess.run and runs the gemini agent with Bash access. (4) Sanitization: shlex.split is used for commands, and _safe_sandbox_dir limits directory traversal but not command logic.
[COMMAND_EXECUTION]: The skill executes shell commands on the host machine to prepare testing environments. These commands are dynamically generated by an LLM based on the content of the file being analyzed. Evidence: In scripts/runner.py, the _setup_sandbox function iterates over scenario.setup_commands and executes them using subprocess.run. While it uses shlex.split to prevent shell-level injection, it does not prevent malicious command logic.
[DYNAMIC_EXECUTION]: The tool generates and runs executable shell command sequences at runtime. Since the source of the command logic is derived from untrusted external input (via the LLM), this creates a significant security risk. Evidence: The setup_commands field in the Scenario object is populated by the output of generate_scenarios in scripts/scenario_generator.py, which is driven by the LLM's interpretation of the provided skill file.

skill-comply