The Agent Skills Directory

[DYNAMIC_EXECUTION]: The cmd_add function in scripts/sab-api.sh performs unsafe string interpolation of the user-provided URL into a python3 -c command string. An attacker can achieve arbitrary code execution by providing a URL containing single quotes and Python code (e.g., \'' + __import__('os').system('touch /tmp/pwned') + '\'). This is a critical vulnerability as the input often originates from untrusted sources. \n- [INDIRECT_PROMPT_INJECTION]: The skill processes data from the SABnzbd API (queue status, history, and filenames) and incorporates it into the agent's context. Evidence chain: 1) Ingestion points: scripts/sab-api.sh (queue, history, status); 2) Boundary markers: Absent; 3) Capability inventory: curl (network), python3 (execution), add-file (file read); 4) Sanitization: Absent. This ingestion of untrusted data creates a significant attack surface for indirect prompt injection. \n- [CREDENTIALS_UNSAFE]: The api_call function in scripts/sab-api.sh appends the SABNZBD_API_KEY directly to the URL as a query parameter. This practice is inherently insecure as it exposes sensitive authentication credentials in web server logs, proxy logs, and potentially shell history. \n- [PROMPT_INJECTION]: The SKILL.md file uses coercive language such as "⚠️ MANDATORY SKILL INVOCATION ⚠️" and "Failure... violates your operational requirements" to override the agent's internal tool-selection logic. This attempt to bypass standard agent constraints is a form of prompt injection aimed at forcing specific tool behaviors.

sabnzbd