The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is vulnerable to arbitrary command injection through unquoted shell argument interpolation.
In SKILL.md, the command python3 /Users/kikuchihiroyuki/stock-skills/.claude/skills/watchlist/scripts/manage_watchlist.py $ARGUMENTS passes user-supplied arguments directly to a bash shell.
If an attacker provides arguments containing shell metacharacters such as ;, &&, or |, they could execute arbitrary commands on the host system.
[DATA_EXFILTRATION]: The skill's supporting script is vulnerable to path traversal attacks when accessing the file system.
The _path(name) function in manage_watchlist.py constructs a file path by joining a base directory with a user-provided name: os.path.join(WATCHLIST_DIR, f"{name}.json").
Because the name argument is not sanitized, an attacker could use parent directory sequences (e.g., ../../) to read or write JSON files outside the intended data/watchlists directory.
[DYNAMIC_EXECUTION]: The script performs dynamic manipulation of the Python module search path.
In manage_watchlist.py, the code sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "..", "..")) adds parent directories to the runtime path.
This technique can be used to load unauthorized local modules if the directory structure is compromised or if there are name collisions with existing libraries.
[INDIRECT_PROMPT_INJECTION]: The skill instructions define a processing pipeline that integrates external, potentially untrusted data without sanitization.
Ingestion points: Output from get_context.py (referenced in SKILL.md) is integrated into the agent's response for add and list operations.
Boundary markers: None. There are no delimiters or instructions provided to the agent to ignore embedded commands within the external context.
Capability inventory: The skill has the capability to write to the file system via _save() and execute shell commands via the definition in SKILL.md.
Sanitization: None. The skill does not describe any filtering or escaping of the content retrieved from get_context.py.

watchlist