The Agent Skills Directory

[COMMAND_EXECUTION]: The capability definitions in CAPABILITY.md (e.g., for lineChart and barChart methods) construct shell commands by directly interpolating user-provided variables such as ${title} and ${options}.
Evidence:
File: CAPABILITY.md
Lines like node /data/clawd/skills/chart-image/scripts/chart.mjs --type line --data "$(cat /tmp/chart-data.json)" --title "${title}" ... perform shell interpolation.
Malicious input for the title field (e.g., \"; touch /tmp/pwned; echo \") could result in the execution of arbitrary commands in the agent's environment.
[INDIRECT_PROMPT_INJECTION]: The skill processes external, potentially untrusted data to generate visualizations, creating a surface for indirect prompt injection or metadata-based attacks.
Ingestion points: The data array and title string in CAPABILITY.md are external inputs that enter the agent's execution context.
Boundary markers: There are no explicit boundary markers or instructions to the agent to ignore malicious patterns embedded within the chart data or metadata.
Capability inventory: The skill possesses the ability to execute shell commands (node scripts) and write files to the /tmp directory.
Sanitization: While JSON.stringify is used to write data to a temporary file, the title field is interpolated into a shell command without sanitization or escaping of shell metacharacters.

chart-image