The Agent Skills Directory

[COMMAND_EXECUTION]: The skill dynamically executes shell commands that are generated by an AI model at runtime. In scripts/runner.py, the _setup_sandbox function executes commands from scenario.setup_commands using subprocess.run. These commands are produced by the scenario generator LLM in scripts/scenario_generator.py based on the untrusted content of the skill file provided as input. While the tool uses shlex.split for command parsing and attempts to sandbox execution in /tmp/skill-comply-sandbox, there is no validation to prevent the LLM from generating dangerous commands such as file deletion or unauthorized network requests if it is successfully influenced by a malicious input file.
[PROMPT_INJECTION]: The skill has a significant indirect prompt injection (IPI) attack surface. It reads the raw content of user-provided skill files and interpolates that content into multiple prompt templates used for spec generation, scenario generation, and results classification (prompts/spec_generator.md, prompts/scenario_generator.md, and prompts/classifier.md). This allows a malicious skill file to potentially override the behavior of the compliance tool's underlying LLM components.
[COMMAND_EXECUTION]: The skill makes extensive use of subprocess.run to invoke the claude CLI across its core modules (runner.py, classifier.py, spec_generator.py, and scenario_generator.py). This provides a broad surface for command-line interaction and potential argument manipulation.

skill-comply