The Agent Skills Directory

[COMMAND_EXECUTION]: The skill constructs and executes several shell commands using variables derived from user input and repository state. In Step 2, it uses the DOCS_PATH argument to change directories and perform git operations: cd DOCS_PATH && git checkout main && git pull && git checkout -b {branch-name}-docs. If the path or branch name is not properly sanitized by the platform, it could be a vector for command injection.
[DYNAMIC_EXECUTION]: Step 9 involves executing local Node.js scripts located within the user-provided documentation directory: node scripts/gen-llms-txt.mjs and node scripts/docs-meta-lint.mjs. This relies on the integrity of the scripts within the target DOCS_PATH and constitutes dynamic execution of local code.
[INDIRECT_PROMPT_INJECTION]: The skill represents an attack surface for indirect prompt injection as it ingests untrusted data from source code files and git diffs to perform documentation edits.
Ingestion points: Source code files and git diffs are read in Step 5; guide directories are searched in Step 7.
Boundary markers: The instructions do not specify the use of delimiters or specific system instructions to ignore potential injection attempts within the processed source code.
Capability inventory: The skill has the capability to execute shell commands (git, grep, npx, node) and write to the file system (Step 6 and Step 9).
Sanitization: There is no mention of sanitizing or escaping the content read from files before it is processed or used in further operations.
[COMMAND_EXECUTION]: Step 7 uses grep with strings (class names and parameter names) extracted directly from source code changes: grep -rl "ClassName\|old_param_name" DOCS_PATH/<guide dirs from profile>. If these symbols were maliciously crafted in the source code to contain shell metacharacters, they could lead to command injection when the agent executes the search.

update-docs