The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions in catalog/report-daily-worklog.md and catalog/report-weekly.md describe shell commands that incorporate user-provided or environment-derived strings without sanitization. The authors argument in catalog/report-daily-worklog.md is used to construct a git log --author="name1\|name2" command. A malicious user could provide a crafted author string (e.g., "; touch /tmp/exploit; #) to execute arbitrary shell commands on the host system.
[INDIRECT_PROMPT_INJECTION]: The skill processes git commit history, which constitutes untrusted external data. Ingestion points: Data is ingested via git log commands in catalog/report-daily-worklog.md and catalog/report-weekly.md. Boundary markers: The instructions do not define boundary markers or delimiters to separate the untrusted commit content from the agent's instructions. Capability inventory: The skill uses subprocess calls to git and performs file-write operations (report-weekly-YYMMDD-YYMMDD.md). Sanitization: There is no evidence of sanitization, escaping, or filtering applied to the commit messages before they are processed and summarized. If a commit message contains malicious instructions, it could attempt to manipulate the agent's behavior during the summarization phase.

work-lgnh