The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/generate_pact_tests.py contains logic in the generate_script method to create new shell scripts from string templates provided via the --content command-line argument. This allows for the generation of arbitrary executable files at runtime based on agent-provided data.- [PRIVILEGE_ESCALATION]: The generate_script function in scripts/generate_pact_tests.py explicitly calls chmod(0o755) on the files it creates. Granting execution permissions to dynamically generated scripts is a privilege escalation vector.- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external API documentation (OpenAPI) and contract files (Pact JSON). These external sources are untrusted and could contain malicious instructions meant to subvert the agent's logic during validation or generation tasks.
Ingestion points: External OpenAPI YAML/JSON files and Pact contract files defined in the configuration or provided as input.
Boundary markers: The skill does not implement delimiters or specific instructions to the model to ignore embedded commands within the processed API data.
Capability inventory: The skill has access to file writing, shell execution (via the Bash tool and generated scripts), and network operations for publishing to a Pact Broker.
Sanitization: There is no evidence of input validation or content sanitization in the script that generates the executable output.- [COMMAND_EXECUTION]: The skill instructions and documentation describe the use of external CLI tools, including pact-broker and openapi-diff, to perform core tasks like contract publication and schema comparison.

validating-api-contracts