The Agent Skills Directory

[COMMAND_EXECUTION]: The mac_release_expand function in scripts/lib/mac_release.sh uses the eval command to process strings retrieved from the project-owned .mac-release.env manifest. This logic can be exploited to execute arbitrary shell commands if the manifest contains malicious payloads.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted configuration data from the repository's .mac-release.env file. Because this data is used in shell expansion and command hooks without proper sanitization, it creates an attack surface for code execution.
Ingestion points: .mac-release.env manifest file and version.env file.
Boundary markers: Absent; values are evaluated or sourced directly into the shell context.
Capability inventory: Arbitrary shell execution through manifest-defined hooks (MAC_RELEASE_PACKAGE_CMD, MAC_RELEASE_PRECHECK) and the expansion of manifest variables.
Sanitization: None; manifest values are expanded using eval.
[DYNAMIC_EXECUTION]: The skill dynamically generates and executes temporary shell and Node.js scripts at runtime to bridge interactions with 1Password and perform JSON parsing.
Evidence: The mac_release_load_1password_env function generates read-op.sh (shell) and parse-item.js (JavaScript) scripts in a temporary directory before execution.

release-mac-app