The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands on the host machine via subprocess.run in scripts/runner.py. These commands (setup_commands) are dynamically generated by an LLM in scripts/scenario_generator.py based on the content of files being analyzed. While shlex.split is used to prevent basic shell injection, the logic of the command itself is determined by an LLM processing untrusted content.
Evidence: scripts/runner.py line 92: subprocess.run(parts, cwd=sandbox_dir, capture_output=True)
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection via the files it processes to generate compliance benchmarks.
Ingestion points: scripts/spec_generator.py and scripts/scenario_generator.py read the content of skill/rule files provided by the user via command-line arguments.
Boundary markers: Absent. The prompts used for spec and scenario generation do not contain delimiters or instructions to ignore embedded commands within the skill content being analyzed.
Capability inventory: subprocess.run calls in scripts/runner.py for setup commands; claude -p execution with Bash, Write, and Edit tool access.
Sanitization: Uses shlex.split and path sanitization for the sandbox directory, but lacks content validation or isolated execution environments (like containers or VMs) for the generated commands.

skill-comply