The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is vulnerable to arbitrary shell command injection through its date parameter. The user-supplied input is stored in the target variable and interpolated into a ripgrep command without sanitization: rg -l \"\\\"timestamp\\\":\\\"${target}\". A malicious user can provide a string that breaks the command context to execute unauthorized scripts.\n- **[DATA_EXFILTRATION]:** The skill accesses highly sensitive private information, including all local AI interaction logs located in ~/.claude/projects/and a personal mission statement fileMISSION.md. While the analysis is intended for local use, keywords derived from this private data are subsequently transmitted to an external service.\n- **[EXTERNAL_DOWNLOADS]:** The skill connects to Tencent's WeRead API (i.weread.qq.com`) to search for books and retrieve chapter information. This requires sending search keywords extracted from the user's private conversation history to a remote endpoint.\n- [PROMPT_INJECTION]: As the skill ingests and processes untrusted text from past user-AI dialogues, it is vulnerable to indirect prompt injection. Malicious instructions hidden in previous conversations could be designed to manipulate the agent's identification of blind spots or influence the selection of recommended literature.

ljg-blind