The Agent Skills Directory

[COMMAND_EXECUTION]: The instructions require the agent to locate and run scripts matching patterns like notarize-*-installer.sh. Executing local files based solely on filename patterns is dangerous, as it allows for the execution of arbitrary code if a malicious script is present in the environment.
[DATA_EXFILTRATION]: The skill directs the agent to search "nearby release/notary checkouts," encouraging the traversal of the filesystem beyond the current working directory. This increases the risk of accessing and potentially exposing sensitive credentials or configurations stored in adjacent project folders.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect injection because it ingests untrusted filenames from the repository and uses them to trigger powerful capabilities (script execution). An attacker could place a malicious script in the repository to gain control over the agent's actions when this skill is invoked.

notarize-mac