The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute a shell command using node and passes the user's raw input directly as a command-line argument (--input ""). This creates a significant risk of command injection. If an attacker provides input containing shell metacharacters like backticks, dollar signs, or strategically placed quotes, they could execute arbitrary commands on the host system where the agent is running.
[PROMPT_INJECTION]: The instructions explicitly mandate a 'no questions' mode and tell the agent to 'not ask for confirmation' and 'not block the capture.' This deliberate bypass of user interaction and verification ensures that any input, including malicious payloads, is processed and written to the filesystem without user oversight.
[INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface for indirect prompt injection by storing untrusted user input in markdown files without sanitization or boundary markers. 1. Ingestion points: User input captured via the instructions in SKILL.md and processed by scripts/capturar_inbox.mjs. 2. Boundary markers: The generated files do not use clear delimiters or 'ignore' instructions to isolate user input from the rest of the document (absent). 3. Capability inventory: The skill has the ability to write to the filesystem and execute shell commands. 4. Sanitization: While there is a high-level instruction to check for credentials, there is no automated sanitization or escaping of the input content before it is stored (absent).

specsfy-01-inbox