The Agent Skills Directory

[COMMAND_EXECUTION]: The decision menu option to create a new skill (Option 5) is vulnerable to shell command injection. The skill takes a name provided by the user and interpolates it directly into a system command: 'python3 .opencode/skills/skill-creator/scripts/init_skill.py [skill-name]'. The absence of input sanitization in this process allows an attacker to execute arbitrary commands by including shell metacharacters (e.g., ';', '&&', or '`') in the skill name.
[PROMPT_INJECTION]: The skill implements an indirect prompt injection surface by capturing data from conversation history and writing it to documentation used as future instructions. Specifically, Option 2 ('Add to Required Reading') promotes solutions to 'critical-patterns.md', which the skill states will be viewed by all subagents before code generation. This creates a persistent channel where malicious instructions embedded in a conversation can influence the logic of other agents. Mandatory Evidence: 1. Ingestion points: Conversation history gathered in Step 2. 2. Boundary markers: Absent in the resolution and critical pattern templates. 3. Capability inventory: Bash, Write, and Grep tools are used for file creation, directory management, and documentation updates. 4. Sanitization: Absent for documentation body content; only the filename receives basic formatting in Step 4.

compound-docs