The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill generates and executes Python code at runtime by interpolating the shell variable $FILTER (sourced from user-provided $ARGUMENTS) directly into a script string passed to python3 -c.
[COMMAND_EXECUTION]: The lack of escaping when inserting $FILTER into the Python command line filt = '$FILTER'.strip().lower() allows for arbitrary Python code injection. A malicious input containing single quotes and Python syntax can escape the string literal and execute commands on the host system.
[CREDENTIALS_UNSAFE]: The execution flow involves reading sensitive authentication tokens from local configuration files, specifically targetting ~/.config/clash/config.yaml and the Clash Verge Rev application support directory.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits a significant vulnerability surface for indirect prompt injection based on the following: 1. Ingestion points: Ingests untrusted data via $ARGUMENTS and external Mihomo API responses. 2. Boundary markers: No delimiters or instructions are provided to the agent to treat external content as untrusted. 3. Capability inventory: The skill utilizes powerful tools including Bash and python3, providing a high-impact exploitation path. 4. Sanitization: There is no evidence of input validation, filtering, or escaping before processing external data.

clash-routes