The Agent Skills Directory

[COMMAND_EXECUTION]: In INSTRUCTIONS.md, the workflow for fetching feeds uses the pattern ruby ... --category {$ARGUMENTS 또는 "all"}. This instruction tells the agent to interpolate user-provided arguments into a shell command. Without strict sanitization by the platform, an attacker could supply arguments containing shell metacharacters (e.g., ;, &, |) to execute arbitrary commands.
[EXTERNAL_DOWNLOADS]: The skill is designed to fetch XML data from various external RSS/Atom feeds. While the default URLs in feeds.yaml are well-known technology and security resources (e.g., NIST, GitHub, Snyk), the mechanism allows the skill to retrieve data from the public internet. Per the analysis rules, downloads from these established services are documented neutrally.
[PROMPT_INJECTION]: The skill ingests untrusted external data from RSS feeds (titles and summaries) and displays it to the agent for analysis. This exposes the agent to indirect prompt injection, where a malicious feed could contain instructions designed to hijack the agent's logic.
Ingestion points: External RSS/Atom feeds defined in feeds.yaml and processed by fetch-feeds.rb.
Boundary markers: None; feed content is placed directly into markdown headers and list items in the final report template provided in INSTRUCTIONS.md.
Capability inventory: The skill has access to Bash for running Ruby scripts, can read project file contents across the ~/pj/ directory, and can write to the local cache directory.
Sanitization: There is basic length truncation (500 characters) in scripts/fetch-feeds.rb, but no sanitization of the content itself to prevent command or instruction injection.

feed