The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute a shell command using an interactive Zsh shell (zsh -ic). This method is specifically intended to load interactive shell aliases, such as the mentioned yolo alias. This is a high-risk pattern as it depends on hidden local configurations that can significantly alter the command's behavior in a way that is not visible in the skill's source code.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted startup proposals and uses them as input for the codex tool via a shell subshell. There are no instructions for sanitizing the input or using boundary markers to prevent the data from being interpreted as code or influencing the command execution.
Ingestion points: User-supplied startup or product proposals defined in SKILL.md §1.
Boundary markers: Absent. The skill does not provide delimiters or instructions to ignore embedded commands within the input data.
Capability inventory: Includes shell command execution via zsh (§4) and web search capabilities (§3).
Sanitization: Absent. The command structure zsh -ic 'codex exec "$(cat /tmp/p.txt)" ...' directly expands the contents of a file containing user-supplied data into the command line.
[DYNAMIC_EXECUTION]: The skill implements a runtime execution pattern where user data is written to a temporary file (/tmp/p.txt) and then immediately executed as an argument to a tool through shell interpolation. This multi-step process is a common vector for injection attacks, especially when combined with the lack of input validation or escaping.

vc-gauntlet