The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions utilize shell commands to perform network requests and file system operations.
Evidence: Uses curl to retrieve metadata from api.brand.dev and download image files. It also uses mkdir to create directories and ls to verify file existence (SKILL.md).
[INDIRECT_PROMPT_INJECTION]: The skill exhibits a vulnerability surface where untrusted data from user input or external API responses is interpolated into executable commands without proper sanitization.
Ingestion points: The DOMAIN variable is sourced from user input, while logo-url, brand-slug, and ext are parsed from the external Brand.dev API response (SKILL.md).
Boundary markers: Absent. There are no instructions or delimiters directing the agent to ignore or sanitize potentially malicious strings within the domain or API data.
Capability inventory: The skill possesses shell execution capabilities through curl, mkdir, and ls commands (SKILL.md).
Sanitization: Absent. The instructions interpolate variables directly into shell commands (e.g., curl ...?domain=${DOMAIN}) without any escaping or validation logic, which could lead to command injection if an attacker provides a crafted domain string like example.com"; <malicious_command> #.

brand-dev