The Agent Skills Directory

[COMMAND_EXECUTION]: In generate-full-report.js, user-supplied input (the user's name) is directly interpolated into a shell command string that is executed using child_process.execSync. While there is a basic check for path traversal characters like .., the sanitization fails to filter shell-sensitive characters such as $, (, ), ;, or backticks. This allows an attacker to perform command injection and execute arbitrary code on the host system.
[COMMAND_EXECUTION]: The skill uses execSync to invoke an external tool (infographic-generator) with a string built from variable data. This pattern of shell execution is inherently risky and can lead to full system compromise if inputs are not strictly validated.
[COMMAND_EXECUTION]: The script simple-fortune.js dynamically loads a module using require() with a path computed at runtime. This practice, known as dynamic loading from computed paths, can be exploited to execute malicious code if the filesystem structure or the variables influencing the path are compromised.
[PROMPT_INJECTION]: The skill exhibits a significant attack surface for indirect prompt injection (Category 8). Untrusted data provided by the user is interpolated into agent prompts without proper sanitization or the use of boundary markers.
Ingestion points: User input is accepted through command-line arguments in fortune.js and simple-fortune.js and used in EnhancedReportGenerator.js.
Boundary markers: The skill does not use delimiters or instructions to help the model distinguish between system instructions and user-provided data.
Capability inventory: The system can execute shell commands, write to the filesystem, and dynamically load code, making the impact of a successful injection high.
Sanitization: There is no evidence of filtering for natural language instructions or prompt-breaking sequences in the user input handling logic.

fortune-teller