The Agent Skills Directory

[COMMAND_EXECUTION]: The runCommand function in skill.js constructs shell commands for the dog CLI by joining an array of arguments with spaces (.join(" ")). Because these arguments include raw user input from parameters such as query (in metric-query), title (in event-post), and message (in host-mute), a user or a malicious data source could provide input containing shell metacharacters (e.g., ;, &, |, $(...)) to execute arbitrary commands. Since the skill is configured with allowed-tools: Bash, these generated commands are likely executed in a shell environment, leading to a command injection vulnerability.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data that is directly used to generate executable shell commands.
Ingestion points: All tool parameters in skill.js that accept strings, including query, name, tags, title, text, hostname, message, and scope.
Boundary markers: Absent. The skill does not implement any delimiters or instructions to treat the ingested data as literal strings rather than executable logic.
Capability inventory: The skill is designed to interact with the host system via the dog CLI and is explicitly allowed to use the Bash tool.
Sanitization: Absent. No shell-quoting, escaping, or character validation is performed on the input arguments before they are joined into a command string.

datadog