The Agent Skills Directory

[COMMAND_EXECUTION]: The skill constructs shell commands by directly interpolating user-supplied strings (such as team names, task descriptions, and messages) into curl command lines. Since these variables are placed inside single-quoted strings without any escaping, an attacker can execute arbitrary shell commands by providing an input that includes a closing single quote and shell control characters (e.g., &&, ;). Evidence: Found in SKILL.md within the 'Spawn Flow' and 'Send Message Flow' sections.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting data from untrusted sources and feeding it into the agent's context. 1. Ingestion points: Data retrieved via curl from http://localhost:4680/api/status, http://localhost:4680/api/teams, and https://api.linear.app/graphql. 2. Boundary markers: No delimiters are used to separate external API content from agent instructions. 3. Capability inventory: The skill has shell execution capabilities via curl and handles sensitive credentials like the Linear API key. 4. Sanitization: There is no validation or escaping of the retrieved content before it is processed by the agent. Evidence: Found in SKILL.md under 'Status Display Format' and 'Agent Details View'.
[EXTERNAL_DOWNLOADS]: The skill mentions the use of npx @cc-commander/fleet for initial setup. This command downloads and executes a package from a public registry that belongs to the author's namespace. Evidence: Found in the 'When activated' section of SKILL.md.

fleet