The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is vulnerable to command injection. It takes user-provided arguments ($ARGUMENTS) and interpolates them directly into shell commands, such as git commit -m "feat: add /<name> skill — <short description>". An attacker could provide a name like my-skill"; touch /tmp/pwned # to execute arbitrary commands.
[COMMAND_EXECUTION]: The skill executes bun run dev -- install -g -y, which performs a global installation on the host system. The -y flag suppresses user confirmation, allowing the skill to modify the system environment with generated content that hasn't been reviewed by the user.
[PROMPT_INJECTION]: The skill facilitates indirect prompt injection by generating new instruction files (SKILL.md) based on untrusted user input. This content is then compiled and installed into the agent's environment, potentially allowing a user to persist malicious instructions across future agent sessions.
[EXTERNAL_DOWNLOADS]: The skill uses git push origin main, which involves network operations to a remote repository. While expected for a development pipeline, it involves external data transfer of the generated assets.

alpha-feature