The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions require the agent to execute shell commands that directly incorporate raw user input from the $ARGUMENTS variable. This creates a critical command injection vulnerability where a user could provide malicious strings containing shell metacharacters (e.g., ;, &&, |) to execute unauthorized commands on the host.\n
Evidence: bash scripts/john/identify-hash-type.sh $ARGUMENTS -j -x in SKILL.md\n
Evidence: hashcat -m 1000 -a 0 $ARGUMENTS wordlist.txt in SKILL.md\n- [DATA_EXFILTRATION]: The skill explicitly instructs the agent to access and process sensitive system files, specifically /etc/shadow and /etc/passwd. These files contain password hashes for all system users and are a primary target for attackers seeking to compromise an environment.\n
Evidence: unshadow /etc/passwd /etc/shadow > combined.txt in SKILL.md\n- [DYNAMIC_CONTEXT_INJECTION]: The skill uses the dynamic context execution syntax to run shell commands during initialization. While the current command is a benign file existence check, this mechanism bypasses standard agent controls and executes code automatically upon loading the skill.\n
Evidence: !test -f scripts/john/identify-hash-type.sh && echo "YES" || echo "NO"`` in SKILL.md\n- [INDIRECT_PROMPT_INJECTION]: The skill provides an attack surface for indirect prompt injection by ingesting untrusted input and passing it to powerful system tools without sanitization.\n
Ingestion points: $ARGUMENTS variable in SKILL.md\n
Boundary markers: None present to delimit user input from shell commands.\n
Capability inventory: Use of bash, john, hashcat, and unshadow tools for file manipulation and command execution.\n
Sanitization: No sanitization, escaping, or validation of user-provided arguments is implemented before they are passed to the shell.

crack