The Agent Skills Directory

[COMMAND_EXECUTION]: The frontmatter of SKILL.md defines a PostToolUse hook that is vulnerable to command injection. The hook uses jq to extract a file path and passes it to xargs, which literalizes the string into a shell command: sh -c 'case "{}" ...'. If a file has a malicious name containing shell metacharacters like semicolons or backticks, it will trigger arbitrary command execution on the host machine.
[DYNAMIC_CONTEXT_INJECTION]: The skill uses the ! syntax in the Project Context section to execute a shell-based grep command at load time. This allows the skill to execute code silently in the background when it is accessed by the agent, which can be a vector for information gathering or more dangerous operations.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to refactor and review Swift code, which involves ingesting untrusted content from the project directory. This creates a surface where malicious instructions embedded in source files could influence the agent's behavior.
Ingestion points: Swift source files identified via grep or edited by the agent.
Boundary markers: No delimiters or instructions are provided to the agent to treat file content as untrusted data.
Capability inventory: The skill can execute shell commands via hooks and perform file system operations using the Edit and Write tools.
Sanitization: There is no validation, escaping, or sanitization of the code content before processing.

swiftui-view-refactor