The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/runner.py executes shell commands defined in setup_commands via subprocess.run. These commands are generated by an LLM based on the content of untrusted input files, creating a surface for command injection.
[REMOTE_CODE_EXECUTION]: Multiple components, including runner.py, scenario_generator.py, spec_generator.py, and classifier.py, invoke the claude CLI using subprocess.run with dynamically generated prompts. These prompts incorporate data from audited files, potentially allowing an attacker to execute unauthorized logic within the agent session.
[PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection. It ingests untrusted markdown files (skills and rules) and interpolates their content into prompts for task generation and classification without sufficient isolation or instructions to ignore embedded commands.
Ingestion points: Path to a skill or rule file provided as a CLI argument.
Boundary markers: Uses triple-dash delimiters in prompts but lacks explicit instructions to the model to ignore instructions inside the variable content.
Capability inventory: Subprocess calls for sandbox management, git operations, and external CLI invocations.
Sanitization: Uses path sanitization to restrict sandbox operations to /tmp/skill-comply-sandbox and shlex.split for command parsing.

skill-comply