The Agent Skills Directory

[COMMAND_EXECUTION]: The skill constructs shell commands in Step 1 using node names extracted from contacts.json without any sanitization or escaping of shell metacharacters. An attacker who controls the contents of this file could include characters like ;, &, or | to execute arbitrary commands on the system.
[PROMPT_INJECTION]: The skill exhibits a significant indirect prompt injection surface by consuming untrusted data from $PSI/contacts.json and using it for privileged operations.
Ingestion points: The maw and name fields within $PSI/contacts.json.
Boundary markers: None. The data is parsed and directly interpolated into commands and file paths.
Capability inventory: Shell command execution via the maw utility and file system writes to the .claude/skills/ directory.
Sanitization: No validation or escaping is performed on the data extracted from the JSON file.
[COMMAND_EXECUTION]: In Step 3, the skill creates new directories and SKILL.md files under .claude/skills/ based on node names from the contacts file. The lack of path validation allows for directory traversal or the creation of files in unintended locations if the node names contain path manipulation sequences such as ../.

machines