The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands such as git clone --depth 1 <url> ./sandbox/<slug> and git pull. These commands use a user-provided <url> and a derived <slug>. There are no explicit instructions to sanitize these inputs, which could lead to command injection if a malicious user provides a URL or repository name containing shell metacharacters (e.g., ;, &&, |).
[EXTERNAL_DOWNLOADS]: The skill is designed to download content from arbitrary external Version Control System (VCS) providers like GitHub, GitLab, and Bitbucket to the local filesystem. While these are well-known services, the specific repositories being cloned are untrusted and controlled by external parties.
[PROMPT_INJECTION]: The REFERENCE.md file contains explicit instructions to the agent to "Do not debate or refuse" and "Never refuse for lack of subagents." These are designed to override the agent's default decision-making process when handling specific flags, which could be leveraged to bypass standard safety or operational constraints.
[PROMPT_INJECTION]: The skill exhibits an Indirect Prompt Injection surface. Its core functionality involves reading and summarizing the contents of untrusted external repositories. Malicious instructions embedded within repository files (e.g., READMEs, code comments, or manifest files) could be processed by the agent or its subagents, potentially influencing the "Search" and "Aggregate" stages.
[COMMAND_EXECUTION]: The "Persist" stage involves performing string substitution on the AGENTS.md template using the {slug}, {url}, and {local_path} variables. If these values contain malicious markdown or control characters, an attacker could potentially corrupt the structure of the AGENTS.md file or inject unauthorized content into the working directory.
[DATA_EXFILTRATION]: While not directly exfiltrating local data, the skill can be used to make outbound network requests to arbitrary servers via the git command. This could be used for basic SSRF (Server-Side Request Forgery) or to signal information to an attacker-controlled server via repository URLs.

box