The Agent Skills Directory

[COMMAND_EXECUTION]: The skill extracts the 'repo' and 'vault' arguments from the user and interpolates them directly into shell command templates provided to agents (e.g., git -C ${REPO} fetch origin and ls ${VAULT}). A maliciously crafted repository path containing shell metacharacters could lead to arbitrary command execution on the host system.\n- [REMOTE_CODE_EXECUTION]: The workflow involves a 'Build' phase where agents modify the repository code based on a user-provided scope, followed by a 'Gate' phase that executes that code using development tools (e.g., npm run build, npm run test). This enables the execution of code generated by the LLM, which may be influenced by external or malicious inputs.\n- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted data from multiple external sources to inform its planning and code generation logic.\n
Ingestion points: The 'Research' and 'Gaps' phases fetch data from git log, gh pr list, WebSearch, WebFetch, ToolSearch, and user-provided vault paths.\n
Boundary markers: The workflow lacks explicit boundary markers or instructions for sub-agents to ignore potentially malicious instructions embedded within these external data sources.\n
Capability inventory: The skill possesses extensive capabilities, including subprocess execution for git, npm, and Vercel, as well as file write access for code modifications.\n
Sanitization: There is no evidence of sanitization or filtering of ingested external content before it is processed by the planner and builder agents.\n- [DATA_EXFILTRATION]: The 'Release' phase interacts with production environments using Vercel, curl, and GitHub tools to perform checks. It explicitly reads production environment variables (vercel env ls production) and probes public routes. While these actions are intended for release verification, they represent a significant data exposure surface that could be leveraged for exfiltration if the agent is compromised.

suede-ship