The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the php drupalorg and git CLI tools to perform operations. Several instructions involve passing raw user input or derived strings directly into shell commands without explicit sanitization or escaping.
The query parameter from the user is passed directly to php drupalorg issue:search <query>.
The project machine name, which can be provided via flags or inferred from git configuration, is passed directly to shell commands.
An attacker could craft a malicious query (e.g., using semicolons or backticks) to execute arbitrary commands on the host system.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8).
Ingestion points: Data is ingested via WebFetch from drupal.org project issue pages and from broader web search results in Step 3b and 3c.
Boundary markers: The instructions lack explicit boundary markers or directions to the agent to ignore instructions embedded within the fetched HTML or search results.
Capability inventory: The agent has the capability to execute shell commands (php drupalorg issue:show <nid>) based on data extracted from these untrusted sources.
Sanitization: While Step 4 and 6 mention parsing 'numeric IDs' (NIDs), which provides a layer of validation for the nid variable, the titles and other metadata extracted from these external pages are used in the final summary and could influence agent behavior if they contain malicious instructions.

drupalorg-issue-search