The Agent Skills Directory

[COMMAND_EXECUTION]: The preamble of the skill contains a bash script that attempts to execute an external file located at ../../check-update.sh. This execution of code from a path relative to the skill's location, rather than within its own directory, allows for the execution of arbitrary shell commands from an unverifiable source.
[DYNAMIC_CONTEXT_INJECTION]: The skill includes a bash code block in the Preamble section designed for initialization. This block runs shell commands, including the call to check-update.sh, which can modify the execution environment or perform unauthorized actions when the skill is loaded or first interacted with.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input through the AskUserQuestion tool across multiple steps and writes this content to documentation files using the Write tool. It lacks explicit sanitization or boundary markers, creating a potential vulnerability surface.
Ingestion points: User-provided descriptions for test backgrounds, hypotheses, variables, and metrics captured in Steps 1 through 5.
Boundary markers: No explicit delimiters or instructions are used to separate or wrap user-provided strings to prevent them from being interpreted as commands or instructions if the documents are later processed.
Capability inventory: The skill has access to Bash, Write, Read, and Agent tools, which provides a high-privilege execution environment for any successfully injected instructions.
Sanitization: There is no evidence of filtering, escaping, or validation of the user-supplied strings before they are persisted to the filesystem in markdown format.

pm-abtest