The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill instructs the agent to search for and execute a Python script (anysearch_cli.py) from multiple potential paths in the user's home directory (e.g., ~/.claude/skills/anysearch/scripts/). Executing code from computed paths at runtime prevents static verification of the script contents and can lead to execution of unauthorized code.
[COMMAND_EXECUTION]: The preamble executes a shell script (../../check-update.sh) using path traversal. This pattern can be exploited to execute arbitrary local files if the skill is placed in a directory containing malicious scripts at that relative location.
[COMMAND_EXECUTION]: User-provided strings (from GEO_TARGET) are interpolated into search queries and passed as arguments to the anysearch_cli.py tool via a shell command. The lack of explicit sanitization or escaping creates a risk of command injection if the user input contains shell metacharacters.
[INDIRECT_PROMPT_INJECTION]: The skill interpolates untrusted user input into a task description for a subagent used in diagnosis. Ingestion points: User-provided search goals and local markdown file content. Boundary markers: None present in the subagent prompt template. Capability inventory: The subagent has access to standard agent tools and web search capabilities. Sanitization: No explicit sanitization or filtering is performed on the user-provided data before interpolation into the subagent's instructions.

pm-geo