The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/todo.sh is vulnerable to command injection because user-supplied input (priority and item descriptions) are passed into shell commands and awk variables without sufficient sanitization. Specifically, in add_item, mark_done, and remove_item functions, inputs are used in awk and sed operations which could be manipulated if a user provides specially crafted task names.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from a TODO.md file and presents it back to the agent context during heartbeats and list commands.
Ingestion points: The TODO.md file is read via cat TODO.md in SKILL.md and parsed by bash skills/todo-tracker/scripts/todo.sh summary during heartbeats.
Boundary markers: None. The content of the TODO file is directly summarized and included in the agent's response/context.
Capability inventory: The skill has the ability to execute shell scripts (bash scripts/todo.sh), read files (cat), and write to the filesystem via the script's redirection and mv commands.
Sanitization: There is no sanitization of the task content before it is stored in TODO.md or before it is displayed back to the agent. An attacker could place malicious instructions in a shared TODO file to influence the agent's behavior when it next processes the summary.

todo-tracker