The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes composer.lock files, which are external data sources that may be controlled by an attacker who has contributed to the repository.\n
Ingestion points: The scripts/diff_lock.py script reads and parses composer.lock JSON files from the project environment.\n
Capability inventory: The skill instructs the agent to execute shell commands generated by scripts/diff_lock.py. The script itself uses subprocess.run to interact with git.\n
Sanitization: The script does not escape or validate package names (pkg['name']) or versions (pkg['version']) retrieved from the JSON lock file before embedding them into shell command strings.\n
Boundary markers: There are no markers or warnings provided to the agent to prevent it from executing malicious instructions that might be embedded in the script's output.\n\n- [DYNAMIC_EXECUTION]: The scripts/diff_lock.py script dynamically constructs shell command strings (e.g., composer require ...) via string concatenation of package metadata. Because these commands are intended for direct execution by the agent, this pattern creates a risk of arbitrary command execution if an attacker manages to place shell metacharacters into the project's dependency metadata.\n\n- [COMMAND_EXECUTION]: The git_show function in scripts/diff_lock.py uses subprocess.run to execute the git binary. The ref argument is taken directly from command-line inputs without validation. While not utilizing a shell for execution, the lack of input filtering allows for potential argument injection attacks against the git show command.

composer-upgrade