The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes dynamic context injection (the !command syntax) combined with unvalidated user input ($ARGUMENTS), leading to a command injection vulnerability.
Evidence: In SKILL.md, the line !cat specs/$ARGUMENTS.md 2>/dev/null || echo "FILE_NOT_FOUND" executes a shell command that incorporates the user's input directly.
Risk: An attacker could provide shell metacharacters (e.g., ;, &&, or backticks) in the argument to execute arbitrary commands with the privileges of the agent process.
[DATA_EXFILTRATION]: The unvalidated use of user input in a file-reading command allows for path traversal attacks.
Evidence: The command !cat specs/$ARGUMENTS.md does not sanitize the $ARGUMENTS variable.
Risk: By providing an argument such as ../../.ssh/id_rsa or ../../.env, an attacker could force the skill to read and potentially expose sensitive configuration files or credentials located outside the intended specs/ directory.
[PROMPT_INJECTION]: The skill implements an indirect prompt injection surface by reading and acting upon instructions found within external specification files.
Evidence: Phase 2 and Phase 4 of the instructions require the agent to parse and follow an 'Implementation plan' and 'Acceptance criteria' found in the spec file (specs/$ARGUMENTS.md).
Risk: If an attacker can control the content of a spec file, they could embed malicious instructions that override the skill's logic or attempt to bypass safety constraints during the implementation phase.

spec-impl