The Agent Skills Directory

[COMMAND_EXECUTION]: The workflow defined in workflow/skill-creation.toon is highly vulnerable to command injection. Parameters such as skill_name, skill_type, and output_path are interpolated directly into shell command strings executed via the adb-shell action. An attacker could provide a malicious parameter value (e.g., using shell metacharacters like ;, &, or $()) to execute arbitrary commands on the target Android device.\n
Evidence: Multiple steps in workflow/skill-creation.toon (e.g., validate_skill_name, generate_skill_md, add_helper_scripts) use vulnerable interpolation patterns where user-controlled variables are not sanitized before being passed to adb shell.\n- [INDIRECT_PROMPT_INJECTION]: The skill serves as a scaffolding tool that generates other skills but fails to properly sanitize user-supplied input before embedding it into the generated skill files. This creates a surface for indirect prompt injection attacks where malicious instructions can be hidden in metadata.\n
Ingestion points: The description and skill_name parameters in adb-skill-generator.py and workflow/skill-creation.toon.\n
Boundary markers: The skill does not use delimiters or instructions to prevent the agent from interpreting embedded malicious instructions in the generated metadata.\n
Capability inventory: The skill has the ability to write files and create executable scripts in the .claude/skills directory, which can be loaded by the agent later.\n
Sanitization: There is no sanitization of the description field, and the name validation in the workflow is itself vulnerable to injection.\n- [DYNAMIC_EXECUTION]: The skill is designed to generate and execute new scripts dynamically. While this is its primary purpose, the lack of input validation combined with chmod +x operations on generated files increases the risk of executing untrusted code generated from malicious inputs.

adb-skill-generator