The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is vulnerable to command injection in Step 2 of the logic. It takes the user-provided {ScreenName} and interpolates it directly into a shell command (grep -r "class {ScreenName}") executed via the Bash tool. A malicious user could provide input containing shell metacharacters (e.g., ;, &, |) to execute arbitrary commands on the host system.
[COMMAND_EXECUTION]: In Step 4, the skill is instructed to "Immediately after presenting: Apply all Tier 1 fixes without waiting." This automated code modification (using the Edit and Write tools) occurs before the user has a chance to review the proposed changes, which could lead to harmful or unexpected modifications if the detection patterns produce false positives.
[PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection (Category 8). It ingests untrusted data from the project's source code files and .perf metadata files to drive its logic. There are no defined boundary markers or sanitization steps to prevent the agent from being misled by instructions embedded within the analyzed code or data files.
Ingestion points: User-supplied ScreenName, local Android/iOS source files, and .perf/data/screen_summary.json.
Boundary markers: None. The skill reads raw file content directly into context.
Capability inventory: File system access (Read, Write, Edit, Glob), search capabilities (Grep), and shell execution (Bash).
Sanitization: No validation or escaping is performed on the {ScreenName} input or the content of the processed files.

perf-fix