The Agent Skills Directory

[COMMAND_EXECUTION]: The workflow in SKILL.md (Step 2) instructs the agent to use the rg (ripgrep) shell command to search local manifests using user-provided <PACKAGE_NAME> and <PACKAGE_VERSION> variables. The template rg -n '"<PACKAGE_NAME>"|<PACKAGE_NAME>@|<PACKAGE_VERSION>' does not include instructions for shell-safe escaping, which could allow a malicious user to perform command injection by providing inputs containing shell metacharacters.
[DYNAMIC_EXECUTION]: The skill requires the agent to dynamically construct Cypher queries by interpolating user-controlled values into predefined templates found in references/cypher-templates.md. While the skill provides manual escaping logic (e.g., escaping single quotes and backslashes), this pattern of manual query assembly is a form of dynamic code generation.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process potentially untrusted data from external sources, including CVE metadata, issue tracker contents (subimageGetIssue), and repository manifests. This data could be crafted by an attacker to include malicious instructions aimed at influencing the agent's logic or the parameters of the tools it executes.
Ingestion points: Data retrieved from subimageGetIssue, query results from subimageRunCypher, and repository file contents searched via rg.
Boundary markers: None. The skill does not instruct the agent to use delimiters or specific ignore-instructions when handling data from these sources.
Capability inventory: The skill has the ability to execute shell commands (rg) and database queries (subimageRunCypher).
Sanitization: Partial. While the skill includes escaping rules for Cypher literals, it lacks sanitization instructions for the shell command template used in the manifest search step.

investigate-package