The Agent Skills Directory

[COMMAND_EXECUTION]: The skill dynamically constructs shell commands using data sourced from a local JSON log file without sanitization.
Evidence: In SKILL.md, the "Process" section instructs the agent to execute cp "{backup}" "{path}" and rm -f "{file}" where the variables are parsed directly from the changes log.
Risk: An attacker who can influence the content of the log file (e.g., through a malicious project file or a previous compromised workflow step) could inject shell metacharacters to execute arbitrary commands or manipulate arbitrary files on the system.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its reliance on untrusted external data to drive logic and tool usage.
Ingestion points: The skill reads the changes log file (e.g., .bug-changes.json) using the Read tool as specified in Step 1 of the Process in SKILL.md.
Boundary markers: There are no delimiters or instructions to treat the ingested JSON as untrusted or to ignore embedded instructions.
Capability inventory: The skill utilizes the Bash, Read, and Write tools, providing a high-privilege execution environment for any manipulated paths.
Sanitization: No validation or escaping mechanisms are implemented for the data read from the log file before it is interpolated into shell command templates.

rollback-changes