The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is vulnerable to shell command injection during the Wi-Fi provisioning step. User-provided SSID and password values are interpolated directly into a bash command string: $CLAUDE_PLUGIN_ROOT/scripts/wifi_setup.sh "<SSID>" "<password>".
Ingestion points: Untrusted strings (SSID and Wi-Fi password) enter the system context via the AskUserQuestion tool.
Boundary markers: No explicit delimiters or instructions are provided to the agent to treat these inputs as non-executable data or to ignore embedded shell instructions.
Capability inventory: The Bash tool is used to execute the resulting command string.
Sanitization: The skill only suggests wrapping the inputs in double quotes, which is insufficient. An attacker or a malicious user input could still execute arbitrary commands via subshell syntax (e.g., $(command)) or backticks inside the quoted strings.
[CREDENTIALS_UNSAFE]: The skill handles sensitive Wi-Fi credentials in an insecure manner by passing them as plaintext positional arguments to a shell script.
Information passed this way is often visible to other users and processes on the machine through process monitoring tools like ps.
Credentials may also be recorded in shell history files (.bash_history, .zsh_history) depending on the environment configuration.
[PROMPT_INJECTION]: The skill instructs the agent to make authoritative safety claims to the user regarding data handling ("Password... won't be written into daemon logs, git repository, or uploaded"). Following these instructions can mislead users into a false sense of security, as the skill analyzer cannot verify the internal behavior of the local daemon or the wifi_setup.sh script referenced.

card-wifi-setup