The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes arbitrary shell commands defined in the setup_commands field of generated scenarios within scripts/runner.py. These commands are produced by an LLM in scripts/scenario_generator.py based on the content of the skill file being analyzed. A malicious skill file could manipulate the LLM into generating harmful commands (e.g., system deletion, unauthorized file access, or data exfiltration) which are then executed on the host system via subprocess.run.\n- [PROMPT_INJECTION]: There is a significant indirect prompt injection surface in scripts/scenario_generator.py and scripts/spec_generator.py. The content of the skill or rule file under analysis is directly interpolated into prompts for the LLM. Ingestion Point: args.skill.read_text() in scripts/run.py passed to generators. Boundary Markers: Content is wrapped in simple --- delimiters in the prompt templates. Capability Inventory: The agent can execute shell commands through the runner.py script. Sanitization: There is no validation or filtering of the LLM-generated commands before execution beyond splitting arguments with shlex.split.\n- [COMMAND_EXECUTION]: The script scripts/runner.py and other generator scripts invoke the claude CLI using subprocess.run with dynamically generated prompts. While the tool use is restricted to a specific set of tools via --allowedTools, the overall behavior is governed by prompts derived from unverified external content.

skill-comply