The Agent Skills Directory

[COMMAND_EXECUTION]: The skill preamble executes a shell script using a relative path that points outside the skill's specific directory (../../check-update.sh). This behavior assumes the presence of a script in the parent directory structure, which could be exploited if a malicious file is placed in that location.
[COMMAND_EXECUTION]: The skill attempts to locate and execute an external Python script (anysearch_cli.py) by checking several hardcoded paths in the user's home directory (e.g., ~/.claude/skills/anysearch/scripts/, ~/.anysearch/scripts/) or using the which command. Dynamically searching for and executing scripts from user-writable directories is a high-risk pattern for command injection or local privilege escalation.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to its data processing workflow:
Ingestion points: Data is read from local files docs/02-方案设计/产品定位方案.md and docs/01-需求调研/市场调研报告.md, as well as user responses via AskUserQuestion.
Boundary markers: The instructions lack any boundary markers or instructions to the agent to ignore potentially malicious embedded commands within these sources.
Capability inventory: The skill has the capability to write to the file system, execute subagents via the Task tool, and run shell commands via Bash.
Sanitization: There is no evidence of sanitization or validation of the ingested content before it is interpolated into the prompt templates for the subagents, allowing malicious text in the documentation to influence subagent behavior.

pm-geo