The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute bash commands (grep, curl, git) using unvalidated placeholders for user input ([KEYWORD] and [TOPIC]). A malicious user can provide input containing shell metacharacters (e.g., ";", "", "$()") to execute arbitrary code on the host machine.- **[DATA_EXFILTRATION]:** The process automates a git push operation on a global directory (~/github/docs-cache/`). This poses a risk of leaking sensitive information to a remote repository if the agent is tricked into caching private files or if the search results contain sensitive data.- [PROMPT_INJECTION]: The skill creates a significant attack surface for indirect prompt injection by processing untrusted data through high-privilege operations.
Ingestion points: User-provided search topics and keywords in SKILL.md.
Boundary markers: No delimiters or instructions are used to separate user data from the agent's instructions.
Capability inventory: Extensive system access including shell execution, file system modification, and network requests across SKILL.md.
Sanitization: No validation, escaping, or sanitization is performed on user inputs before they are used in shell strings or JSON payloads.

freesearch