The Agent Skills Directory

[COMMAND_EXECUTION]: A shell command injection vulnerability exists in the Step 0 workflow. The skill derives the $CURRENT_REPO variable from git remote get-url or basename "$PWD" and then interpolates it unquoted into the $RECALL_FLAGS variable. This variable is subsequently used without quotes in a shell execution (uv run). An attacker who convinces a user to clone a repository into a specially named directory (e.g., containing semicolons or backticks) could achieve arbitrary command execution.
[DYNAMIC_EXECUTION]: The skill uses uv run to execute a Python script located at a local path (~/.claude/skills/memory/recall/scripts/memory_recall.py). While this appears to be a modular skill invocation, executing code from dynamically constructed local paths carries risk if the integrity of the target directory is not guaranteed.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests untrusted data to determine the agent's next action.
Ingestion points: git log (commit messages), git status (file names), gh pr list (pull request titles), and gh issue view (issue titles and labels) are all read into the session context in SKILL.md.
Boundary markers: No boundary markers or 'ignore' instructions are used to delimit the external data from the skill's logic.
Capability inventory: The agent has the capability to execute shell commands (git, gh, uv), read local files, and suggest actions that the agent may auto-execute.
Sanitization: There is no evidence of sanitization, escaping, or validation performed on the ingested strings before they are passed to the routing engine in Step 4.

progress