The Agent Skills Directory

[COMMAND_EXECUTION]: The setup bash script is vulnerable to shell command injection via unsanitized positional parameters. The script assigns values from $1, $3, and $5 to variables and then incorporates them into double-quoted shell commands. Since bash evaluates command substitutions (e.g., $(...)) within double quotes, an attacker could execute arbitrary code by supplying a malicious service name, profile name, or domain.\n
Evidence in setup script:\n
CONNECTION=$(kernel auth connections create --domain "$DOMAIN" --profile-name "$PROFILE_NAME" -o json)\n
EXISTING=$(kernel auth connections list -o json | jq -r ".[] | select(.domain == \"$DOMAIN\" and .profile_name == \"$PROFILE_NAME\") | .id" 2>/dev/null || echo "")

kernel-auth