The Agent Skills Directory

[COMMAND_EXECUTION]: The shell script template templates/check-design-tokens.sh contains a command injection vulnerability. It uses unquoted shell variables $SRC_DIRS and $EXCLUDE_FILES which are intended to be populated by the agent via placeholders {{SRC_DIRS}} and {{EXCLUDE_FILES}}. In SKILL.md step 4, the agent is instructed to substitute these placeholders and make the script executable. If a repository contains directories with shell metacharacters (e.g., src; rm -rf /), the resulting script will execute those commands when invoked.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface. The agent is instructed to automatically detect project structure and 'substitute placeholders' in a shell script based on what it finds in the environment.
Ingestion points: The agent reads the repository's directory structure and package.json to identify target stacks and source directories.
Boundary markers: None. There are no instructions or markers to prevent the agent from including malicious strings found in the file system into the script output.
Capability inventory: The skill creates an executable shell script and wires it into the project's scripts and CI pipeline, enabling recurring command execution.
Sanitization: Absent. The script template lacks quoting or validation for the substituted variables, and the instructions do not specify any sanitization steps for the agent.

setup-design-handoff