The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to generate and execute Bash scripts that interpolate unvalidated user input into shell commands and heredocs. Specifically, in Step 2.2.3 of SKILL.md, the natural language task description is written to a file using an unquoted heredoc (<<EOF), allowing for command substitution if the user input contains shell metacharacters like backticks or dollar-parenthesis. Similarly, Step 2.2.1 passes user input directly as a command-line argument to a node process.\n- [REMOTE_CODE_EXECUTION]: The skill uses 'npx' to download and run 'oh-my-design-cli' during setup and health-check operations (Step 1.1). This involves executing code from an external registry that is not part of the defined trusted sources list, creating a dependency on unverified remote code at runtime.\n- [DYNAMIC_EXECUTION]: The skill dynamically identifies and executes JavaScript helper files (e.g., ctx-prime.cjs, design-council-prime.cjs) found in hidden platform directories or package folders. These scripts are invoked via 'node' with arguments derived from the repository environment, representing a dynamic execution vector with a wide search path.\n- [INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection due to its role as an orchestrator. Ingestion points: Processes user task descriptions and external repository code (analyzed via ctx-prime.cjs). Boundary markers: Lacks markers or warnings when generating the bootstrap shell scripts. Capability inventory: Includes shell command execution, file system modification, and sub-agent orchestration. Sanitization: Sanitization is limited to filename slugs and does not cover the primary content written to configuration and task files.

omd-harness