The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute a shell command (gemini -p "{{ARGUMENTS}}") using direct interpolation of user-supplied data. This pattern is susceptible to command injection if the input contains shell metacharacters such as backticks, semicolons, or subshell syntax, potentially allowing arbitrary execution in the local environment.
[PROMPT_INJECTION]: The skill facilitates an indirect prompt injection surface by taking raw user input and passing it to an external model, then ingesting the resulting output back into the agent context to create artifacts. 1. Ingestion points: The {{ARGUMENTS}} variable in SKILL.md is the entry point for untrusted input. 2. Boundary markers: The input is enclosed in double quotes within the shell command, but no explicit instructions are given to the agent or external model to ignore embedded malicious instructions. 3. Capability inventory: The skill is capable of shell execution and writing files to the artifacts/ directory. 4. Sanitization: No input validation or output filtering is implemented to mitigate the risk of processing adversarial instructions.

afk-ask-gemini