The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/publish_skill.py is vulnerable to command injection. It extracts the name field from a skill's SKILL.md frontmatter and interpolates it directly into a shell command string that is executed using subprocess.run with shell=True. A malicious skill name containing shell metacharacters (e.g., skill-name; rm -rf /) would result in arbitrary code execution in the user's shell context.
[COMMAND_EXECUTION]: The script extensively uses subprocess.run with shell=True for various tasks involving user-controlled or file-extracted variables, including git operations, gh CLI calls, and npx commands. This pattern is inherently unsafe for handling potentially untrusted data.
[COMMAND_EXECUTION]: The script modifies the user's home directory by creating symbolic links in ~/.agents/skills/. This is intended to facilitate sharing skills across different AI agent platforms, but it represents a side effect on the host system configuration beyond the project directory.

skill-publisher