The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands using local AI CLI tools (claude, codex, gemini) to process user requests.
Evidence: File SKILL.md specifies command templates like claude --permission-mode plan -p "{{PROMPT}}".
Vulnerability: User input from {{ARGUMENTS}} is formatted into {{PROMPT}} and then interpolated into a shell command. There are no instructions for the agent to sanitize or escape this input, which could allow an attacker to perform command injection (e.g., by including shell metacharacters like ;, |, or ` in their prompt).
Autonomy Risk: The skill instructs the agent to inspect --help and adapt command flags if the default ones fail, which grants the agent significant autonomy in constructing and executing shell commands based on runtime observations.
[PROMPT_INJECTION]: The skill exposes an attack surface for indirect prompt injection by processing untrusted input alongside powerful tool capabilities.
Ingestion points: Untrusted data enters the agent context through the {{ARGUMENTS}} variable in SKILL.md, which is then mapped to the {{PROMPT}} used in CLI execution.
Boundary markers: Absent. There are no boundary markers or delimiters specified to isolate the user-provided prompt from the surrounding command context or to instruct the advisor model to ignore instructions within the prompt.
Capability inventory: The skill utilizes shell execution capabilities via the claude, codex, and gemini CLI commands.
Sanitization: Absent. No sanitization, escaping, or validation logic is defined to filter the external prompt content before it is interpolated into shell commands.

afk-ask