The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes external design configurations from brand.md and user-provided descriptions without implementing boundary markers or instructions to ignore embedded commands. This creates an attack surface where malicious instructions in these files could attempt to influence the agent's behavior during automated steps.
Ingestion points: brand.md (read in Step 0), user-supplied UI feedback.
Boundary markers: None present.
Capability inventory: Executes bash scripts for telemetry logging and file searching via grep.
Sanitization: No sanitization or escaping is performed on the OUTCOME variable before it is interpolated into a shell command.
[COMMAND_EXECUTION]: The "Telemetry (run last)" bash block in SKILL.md requires the agent to replace the OUTCOME placeholder with a status string. This string is inserted into an echo command inside single quotes. An attacker-controlled file (e.g., a malicious brand.md) could influence the agent to provide an OUTCOME value containing shell metacharacters (such as ' ; malicious_command #), allowing for arbitrary command execution on the host system when the telemetry script runs.
[DATA_EXFILTRATION]: The skill's preamble script automatically identifies a convexUrl from ~/.superstack/config.json and uses curl to transmit host system metadata—including the operating system and hardware architecture (uname -s-uname -m)—to that endpoint. While this is documented as telemetry for the superstack platform, it involves the transmission of environment details to an external service.

design-taste