The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill performs dynamic code execution by generating temporary TypeScript (.ts) scripts in a scratch directory (.tmp_deploy/) and executing them using the Bun runtime (bun run). These scripts are constructed using data extracted from user-supplied *-semantic-spec.md files. Although the skill employs JSON.stringify to mitigate shell injection, the pattern of generating and executing scripts based on external input represents a significant security surface.
[COMMAND_EXECUTION]: The skill makes extensive use of the semantius CLI tool to perform catalog operations. It executes subcommands such as create_entity, update_entity, and postgrestRequest by spawning processes via Bun.spawn within its deployment and seeding logic. It also executes a consistency-check script from a sibling skill directory.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted data from semantic specification files and incorporates it into the logic for catalog deployment and sample data generation.
Ingestion points: The skill reads and parses user-supplied *-semantic-spec.md files during Stage 1.
Boundary markers: There are no explicit delimiters or boundary markers used to isolate user-provided text (such as entity descriptions) from the operational instructions.
Capability inventory: The skill can write to the local file system, execute shell commands, and interact with vendor-specific CLI tools.
Sanitization: While the skill uses JSON serialization for transport to prevent shell-level command injection, it does not perform semantic sanitization to prevent embedded instructions in descriptions from influencing agent behavior.

semantius-modeler