The Agent Skills Directory

[COMMAND_EXECUTION]: The SKILL.md instructions guide the agent to perform an unsafe shell operation. Under the "Step 0: Semantic self-route" section, it mandates the execution of a bash snippet: REQUEST_FILE=$(mktemp); printf '%s' "{user_request}" > "$REQUEST_FILE". Directly interpolating untrusted user input ({user_request}) into a shell command without sanitization or proper escaping allows for command injection. A malicious user could craft a request containing shell metacharacters (e.g., $(command) or backticks) to execute arbitrary code on the host system.
[INDIRECT_PROMPT_INJECTION]: The parallel analysis methodology (defined in references/parallel-analysis.md) creates an attack surface for indirect prompt injection. The skill ingests untrusted "source material" from a user-specified path and processes it using multiple analysis agents. The synthesized findings are then used to automatically modify other agents and skills in the repository.
Ingestion points: The source-path argument in Phase 1 of the parallel analysis (references/parallel-analysis.md).
Boundary markers: The perspective prompts (in references/perspective-prompts.md) lack delimiters or explicit instructions to treat the source material as data rather than instructions, which could lead the agents to obey commands hidden in the source files.
Capability inventory: The skill uses Bash, Skill, and Task tools to modify local repository files (agents/*.md and skills/*/SKILL.md), giving a successful injection the power to compromise the integrity of the entire agent toolkit.
Sanitization: There is no evidence of sanitization or filtering of the content extracted from the source material before it is used to update local agent/skill definitions.

do