The Agent Skills Directory

[DYNAMIC_EXECUTION]: The initialization script scripts/init-sveltia.sh uses an unquoted heredoc (cat << EOF) to generate the config.yml file. This pattern causes the shell to execute variable expansion and command substitution on the content before writing it to the file. If the $REPO or $BRANCH variables contain command substitutions such as $(...) or backticks, those commands will be executed by the shell while the script is running.
[INDIRECT_PROMPT_INJECTION]: The skill exposes an attack surface for indirect prompt injection by processing untrusted repository and branch names without proper validation or sanitization.
Ingestion points: The script scripts/init-sveltia.sh collects the $REPO and $BRANCH variables from user input via the read command.
Boundary markers: The script lacks any validation or delimiters to ensure the input remains within its intended scope and does not include malicious shell commands or YAML structure overrides.
Capability inventory: The skill is granted Bash and Write permissions, which enable the execution of the vulnerable script and the modification of the local file system.
Sanitization: There is no escaping or sanitization of the input variables before they are interpolated into the shell's execution environment.
[EXTERNAL_DOWNLOADS]: The skill templates reference the @sveltia/cms library hosted on the unpkg.com CDN. This is the official and standard distribution method for the tool and utilizes a well-known service, posing no unexpected security risk in this context.

sveltia-cms