The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/consult.sh contains a code injection vulnerability in the get_article_content function. The $slug variable is directly interpolated into a Python string literal executed via python3 -c. If an attacker can influence the filename or the input passed to this function, they could execute arbitrary Python code.
[DATA_EXFILTRATION]: The skill accesses and exposes the contents of JSON files located in the user's home directory ($HOME/drli_articles). While intended for its primary function, this demonstrates a pattern of local data exposure and potential harvesting of user-specific data files.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to how it handles untrusted data.
Ingestion points: Data is ingested from external JSON files located in $HOME/drli_articles/ via the search and topic commands.
Boundary markers: There are no boundary markers or instructions telling the agent to ignore embedded commands within the ingested JSON content.
Capability inventory: The skill uses grep, python3, and cat to read and display data, which is then processed by the agent.
Sanitization: No sanitization or filtering is performed on the content retrieved from the data files before it is presented to the agent.

binlee-consumer