The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/manage-dev.ts utility script is vulnerable to command injection in its commandInit function. The script uses execSync to execute a git clone command, interpolating the featureName argument directly into the shell command string without any sanitization or escaping. A malicious prompt or user-supplied feature name containing shell metacharacters (e.g., feature; id) could result in arbitrary code execution on the host system.
[REMOTE_CODE_EXECUTION]: The initialization feature in scripts/manage-dev.ts supports cloning external template repositories. The target URLs are sourced from scripts/templates.json. This functionality provides a mechanism to download and place external, potentially untrusted code into the local project directory.
[INDIRECT_PROMPT_INJECTION]: The skill instructions in SKILL.md direct the agent to ingest and act upon data from CONTEXT.md and ROADMAP.md. These files are untrusted data sources that could be used to inject malicious instructions into the agent's context.
Ingestion points: The agent reads ROADMAP.md and CONTEXT.md during the session start workflow; the scripts/manage-dev.ts script also parses these files.
Boundary markers: There are no boundary markers or instructions to ignore embedded commands within the ingested markdown files.
Capability inventory: The skill has access to shell command execution (via the vulnerable helper script), file system writes, and Git operations.
Sanitization: No sanitization, validation, or escaping is performed on the content extracted from the project documentation files before it is processed.

session-support