The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill documents and encourages the use of a dynamic context injection feature using the !cmd syntax. This allows shell commands to be executed automatically when a command template is loaded, with the output injected directly into the agent's prompt.
Evidence: SKILL.md and references/frontmatter-reference.md describe the use of !`command` to fetch live project state (e.g., git log, git status).
[COMMAND_EXECUTION]: The skill provides examples of arbitrary shell command execution. Specifically, it demonstrates a pattern where user input is directly embedded into a shell command string, which is a classic command injection vector.
Evidence: In references/command-patterns.md, the /issues example uses the pattern !`gh issue list --search "$ARGUMENTS" --limit 10`. If the $ARGUMENTS placeholder is not sanitized by the execution environment, a user could execute unauthorized commands by including shell metacharacters in their input.
[INDIRECT_PROMPT_INJECTION]: The skill facilitates the creation of workflows that ingest untrusted data from external sources, creating an attack surface for indirect prompt injection.
Ingestion points: External data enters the agent context through shell command outputs (!cmd) and project file inclusions (@filename).
Boundary markers: The instructions recommend using XML blocks (e.g., <context>, <target>, <objective>) to organize data, which provides some structural separation but does not prevent the agent from following instructions embedded within the ingested data.
Capability inventory: Commands created using this skill can have full read, write, and execute permissions (the default 'build' agent setting).
Sanitization: The skill does not provide instructions or best practices for sanitizing or escaping the content of these external data sources before they are processed by the agent.

opencode-design-commands