The Agent Skills Directory

[COMMAND_EXECUTION]: The Python scripts backup.py and restore.py implement a common helper function run() that executes system commands using subprocess.run(shell=True). This execution mode is inherently risky as it invokes a shell environment for command processing.
[COMMAND_EXECUTION]: Command strings are constructed using f-strings that incorporate variables derived from script arguments without any shell escaping. For example, in scripts/backup.py, the commit_msg (from the --message flag) is directly placed into a git command: run(f'git commit -m "{commit_msg}"', cwd=backup_dir). An attacker providing a message like "; touch /tmp/pwn; # could execute arbitrary code.
[COMMAND_EXECUTION]: Similar injection patterns exist in scripts/backup.py for the repository name during gh repo view and gh repo create operations, and in scripts/restore.py where the repository name influences the git clone command parameters.
[COMMAND_EXECUTION]: The reliance on string interpolation for shell commands instead of passing arguments as a list to subprocess.run creates a significant attack surface if the agent is tricked into passing malicious strings via prompt injection.

memory-backup