The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/append_entry.sh is vulnerable to command injection through its arguments. When writing the new markdown file, it uses an unquoted heredoc (<<EOF), which causes the shell to evaluate any command substitutions (e.g., $(...) or `...`) present in the TOPIC, STATUS, or SUMMARY variables. If an agent populates these arguments with untrusted user input, the shell will execute the embedded commands during the script execution.
[DYNAMIC_EXECUTION]: The use of unquoted heredocs to generate file content from external variables allows for the dynamic evaluation of code at runtime. The shell expands variables and executes command substitutions within the heredoc body before writing the content to the filesystem.
[INDIRECT_PROMPT_INJECTION]: The skill architecture allows untrusted user data to reach a sensitive sink (a shell script with a command injection vulnerability) without proper sanitization.
Ingestion points: User-provided strings for log entries (specifically the topic and summary fields) processed by the agent and passed to scripts/append_entry.sh.
Boundary markers: None identified; the skill does not instruct the agent to use delimiters or escape the content.
Capability inventory: File system writes and shell script execution within the scripts/ directory.
Sanitization: Absent; the script arguments are passed directly to shell variables that are interpreted inside an unquoted heredoc.

doc-append-log