The Agent Skills Directory

[COMMAND_EXECUTION]: The skill-finalize.sh script executes chmod +x on files within a path constructed from the --name argument. There is no validation to ensure the name does not contain path traversal characters (e.g., ../), potentially allowing an agent to change permissions of files outside the intended skills/ directory.
[PRIVILEGE_ESCALATION]: The use of chmod +x in skill-finalize.sh allows for the elevation of file permissions. While intended for skill development, this capability can be abused to make malicious scripts executable if combined with file-writing tools, especially when combined with the path traversal vulnerability in the directory selection.
[DYNAMIC_EXECUTION]: The skill is explicitly designed to guide the agent in scaffolding, writing, and executing new scripts. While this is the primary purpose of the skill, it creates a significant surface for the introduction and execution of arbitrary code within the agent's environment.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The scripts/skill-context.sh script reads and parses the description field from every SKILL.md file located in the skills/ directory.
Boundary markers: There are no boundary markers or instructions provided to the agent to ignore potentially malicious embedded instructions when the parsed metadata is presented in the context.
Capability inventory: The skill possesses the capability to write new files and grant them execution permissions via the skill-finalize.sh script.
Sanitization: While the script uses json_escape to ensure valid JSON output, it does not sanitize or filter the content of the skill descriptions, allowing instructions within those descriptions to influence the agent's behavior during the 'Clarify' and 'Build' phases.

pflow-skill