The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/match_directors.sh is vulnerable to shell command injection. It assigns the first command-line argument to a variable (DEMAND="$1") and then interpolates that variable directly into a double-quoted string within an echo command (echo "创作需求: $DEMAND"). Because Bash evaluates command substitutions within double quotes, any input containing backticks or $(...) syntax will be executed by the shell when the script runs.
[DYNAMIC_EXECUTION]: The provided utility script scripts/match_directors.sh performs dynamic evaluation of untrusted user input within a shell environment. This allows for the execution of arbitrary system commands, posing a risk to the host environment if the script is invoked with data from an untrusted source.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The first command-line argument ($1) provided to scripts/match_directors.sh.
Boundary markers: Absent. The input data is interpolated directly into shell command strings without delimiters or protective warnings.
Capability inventory: The script has the capability to execute shell commands and perform text searches using grep.
Sanitization: Absent. There is no evidence of escaping, filtering, or validation performed on the input string to remove shell metacharacters.

clawteam-directors-orchestrator