The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts search.sh, departures.sh, route.sh, and disruptions.sh are vulnerable to shell command injection. User-supplied arguments are interpolated into the curl command using a pattern ('"$VAR"') that terminates the single-quoted shell string to expand the variable. An attacker providing input containing a single quote (e.g., ' ; command ; ') can break out of the intended JSON payload and execute arbitrary shell commands with the agent's privileges. Evidence is found in all four bash scripts where input variables are directly used in the -d parameter of curl calls.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes external data which could be sourced from untrusted third-party content.
Ingestion points: Inputs for station search and route planning in search.sh, departures.sh, and route.sh.
Boundary markers: Absent; there are no instructions for the agent to ignore potentially malicious content within input variables.
Capability inventory: The skill has the capability to execute shell commands via curl subprocesses across multiple scripts.
Sanitization: Absent; inputs are directly concatenated into shell commands without escaping or validation.
[EXTERNAL_DOWNLOADS]: The scripts interact with the HAFAS API at vao.demo.hafas.de. This is a well-known service used for Austrian public transport information.

anachb