The Agent Skills Directory

[COMMAND_EXECUTION]: The shell script provided for saving artifacts in SKILL.md uses an unquoted heredoc delimiter, which is a significant security risk when handling variable data.
Evidence: cat > "$ARTIFACT_FILE" <<EOFJSON in the post-protocol section of SKILL.md.
Description: Using <<EOFJSON (unquoted) instead of <<'EOFJSON' allows the shell to perform variable expansion and command substitution ($(...)) on the content before writing. If the agent populates the JSON template with untrusted user input containing shell payloads, those payloads will be executed by the Bash tool.
[DATA_EXFILTRATION]: The skill automatically collects project and environment metadata using Git commands.
Evidence: PROJECT_ROOT=$(git rev-parse --show-toplevel), BRANCH=$(git branch --show-current), and COMMIT=$(git rev-parse --short HEAD) in SKILL.md.
Description: The skill extracts project structure and version control history. While this is used for local artifact logging, the automated discovery of environment details is a common prerequisite for data exfiltration.
[PROMPT_INJECTION]: The skill demonstrates a high-risk surface for indirect prompt injection by processing and storing untrusted user requests in a structured format without sanitization.
Ingestion points: The user_request field within the artifact generation script in SKILL.md.
Boundary markers: None; untrusted data is directly interpolated into a JSON structure processed by a shell script.
Capability inventory: The skill has access to powerful tools including Bash, Write, Edit, and Glob.
Sanitization: None; there are no instructions for escaping or validating external content before it is stored or processed.

pdca-cycle