The Agent Skills Directory

[COMMAND_EXECUTION]: The change-archive.mjs script is vulnerable to command injection via the --id parameter. The script interpolates this parameter into a shell command for zip within double quotes, allowing the execution of shell commands embedded in the ID (e.g., using $(command) syntax).\n- [COMMAND_EXECUTION]: The context-verify.mjs script uses execSync to run other scripts and git diff commands. Variables such as repoRoot, sha, and dirPath are interpolated into shell command strings without sanitization or proper escaping, enabling command injection through crafted project structures or malicious CONTEXT.md file content.\n- [COMMAND_EXECUTION]: Utility functions in lib/index.mjs, specifically getChangedFilesSince, execute shell commands using execSync with unsanitized parameters, propagating command injection risks to any script utilizing these shared utilities.\n- [DATA_EXFILTRATION]: The change-archive.mjs script is susceptible to path traversal. The --id parameter can be manipulated to reference directories outside the intended .changes/ workspace (e.g., using ../../../), which could lead to arbitrary file deletion via fs.rmSync.\n- [INDIRECT_PROMPT_INJECTION]: The skill's primary function (Phase 1) involves exploring and analyzing an untrusted prototype codebase. Malicious instructions embedded in this code could influence the agent's behavior, potentially leading to the exploitation of the aforementioned script vulnerabilities or other unauthorized actions.

reforge