The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides example code for tool functions that are vulnerable to command injection through unsafe variable interpolation.
The tool_process_list template uses grep -i "$filter" where $filter is derived from user-controlled JSON input. This allows shell metacharacters (e.g., ;, |, &) to execute arbitrary commands.
The tool_disk_usage template interpolates $path into an awk print statement using string concatenation: awk 'NR==2 { print "{\"path\":\"'$path'\"..." }'. This allows an attacker to break out of the awk string to execute arbitrary logic.
[EXTERNAL_DOWNLOADS]: The installation instructions direct users to clone and execute scripts from a third-party GitHub repository (muthuishere/mcp-server-bash-sdk) that does not belong to a recognized trusted organization.
[INDIRECT_PROMPT_INJECTION]: The skill defines a significant attack surface for indirect prompt injection via the following indicators:
Ingestion points: Tool function arguments ($args) extracted from JSON-RPC calls in SKILL.md.
Boundary markers: Absent in all provided code templates and documentation.
Capability inventory: Includes network access (curl), file system reading (cat), system monitoring (ps, df), and directory/file creation (mkdir, echo >).
Sanitization: The provided examples lack input validation or shell-safe escaping (such as @sh in jq), which makes tools built using these patterns susceptible to malicious instructions embedded in data processed by the agent.

mcp-server-bash-sdk