The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions in Phase 1 (Pre-Plan) explicitly direct the agent to execute shell commands using unvalidated user input. Specifically, it uses the pattern python3 scripts/get_context.py "<ユーザー入力>" and python3 scripts/extract_constraints.py "<ユーザー入力>". A malicious user could provide input containing shell metacharacters (e.g., "; touch /tmp/pwned; #) to execute arbitrary commands on the host system.
[REMOTE_CODE_EXECUTION]: Due to the command injection vulnerability described above, the skill effectively allows for remote code execution. By injecting commands into the <ユーザー入力> placeholder, an attacker can execute arbitrary scripts or binaries available on the system.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from several untrusted external sources, creating a risk of indirect prompt injection.
Ingestion points: The skill fetches data via WebSearch, yfinance, and the Grok API (through scripts/run_research.py), as well as processing raw user input.
Boundary markers: The instructions do not define any delimiters or boundary markers to separate external data from the agent's instructions.
Capability inventory: The skill has access to a wide range of powerful local scripts including run_portfolio.py (which manages portfolios and executes 'what-if' scenarios), manage_watchlist.py, and run_screen.py.
Sanitization: There is no evidence of sanitization, filtering, or validation of the content retrieved from external APIs or web searches before it is analyzed by the Orchestrator agent.

plan-execute