The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/validate-skills-lock.sh contains a command injection vulnerability. It interpolates the shell variable $SKILL_NAME (derived from local directory paths found via find) directly into a Python command string passed to python3 -c. Because the variable is placed inside single quotes within the Python command without any sanitization or escaping, an attacker who can create directories in the target repository could execute arbitrary Python code. For example, a directory named skills/name');import os;os.system('ls');# would terminate the intended Python string and execute the injected os.system command. This represents a significant security risk if the agent is instructed to validate a repository containing untrusted file or directory names.

skills-lock