The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection via malicious tags files.
Ingestion points: The TAGS_FILE (referenced in scripts/lookup.sh and scripts/lookup.cmd) is an external data source that may be provided by a third party or generated from untrusted code.
Boundary markers: There are no boundary markers or instructions to the agent to validate or ignore malicious content within the processed tags data.
Capability inventory: The skill outputs file paths (File) and line numbers (Line) intended for the agent to use in navigating to source definitions, which usually involves file-read operations.
Sanitization: The scripts/parse-ctags.jq filter does not validate the file paths extracted from the tags file, meaning a crafted index could point the agent to sensitive system files (e.g., .env, /etc/passwd).
[COMMAND_EXECUTION]: The search scripts are vulnerable to command flag injection via the symbol name argument.
In scripts/lookup.sh, the escaping logic sed 's/[][\\.^$*+?{}()|]/\\&/g' only handles regex metacharacters but does not escape double quotes.
Because the symbol name is interpolated into the ripgrep command line within double quotes (rg ... -e "$RG_PATTERN"), an attacker could provide a name containing a double quote to terminate the argument and inject additional flags into ripgrep.
For example, a name like " -f /path/to/sensitive/file " could cause the search tool to read patterns from an unintended file, leading to potential data exposure.

ctags-lookup