The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is vulnerable to command injection within the subagent instructions. It directs the agent to execute a shell command (python3 <路径> search "查询词") where the search term is interpolated directly into the string. If the keywords, which can be sourced from external files or user input, contain shell metacharacters like semicolons or backticks, it could lead to arbitrary command execution on the host system.
[COMMAND_EXECUTION]: The preamble script executes check-update.sh using a relative path (../../) that moves two levels above the skill's root directory. Executing scripts from outside the skill's package is a security risk as it depends on the directory structure of the environment and could target unverified scripts.
[DYNAMIC_EXECUTION]: The skill instructions require subagents to search through several hidden system directories (including ~/.claude/, ~/.cursor/, ~/.opencode/, and ~/.anysearch/) for a Python script named anysearch_cli.py and execute it. Probing for and running executables from computed system paths is a form of dynamic execution that can be exploited if malicious code is placed in those common skill paths.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external websites via web search tools to perform its market analysis. This external data is processed by the agent without clear boundaries or sanitization, creating a surface for indirect prompt injection attacks.
Ingestion points: Content retrieved from the WebSearch and mcp__exa__web_search_exa tools.
Boundary markers: The skill does not use specific delimiters or instructions to ensure the agent ignores potentially malicious instructions embedded in the search results.
Capability inventory: The skill has access to Bash, Write, and Agent tools, which could be misused if the agent is influenced by injected instructions.
Sanitization: There is no evidence of input validation or escaping for the data fetched from external web sources before it is processed.

pm-market