The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to construct and execute shell commands using string interpolation of potentially untrusted file paths and configuration values. The templates provided for nohup, grip, and the custom IDE launcher (Antigravity IDE) do not specify any form of shell escaping or sanitization. This allows for command injection if a file path or URL contains shell metacharacters such as backticks or semicolons. Additionally, the skill loads the executable command and its args from a project-level configuration file (.agents/skills-config/open/config.json), which could be maliciously modified in a shared repository to execute arbitrary code when the skill is invoked.
Evidence: nohup "<command>" <args...> "<file://absolute-path または URL>" in SKILL.md.
Evidence: grip -b "<absolute-path>" in SKILL.md.
Evidence: "$AGY_IDE" --goto "<absolute-path>:<line>" in SKILL.md.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection via the project environment. An attacker can create a file with a malicious name or provide a compromised configuration file that, when processed by the agent, leads to the execution of arbitrary commands via the Bash tool.
Ingestion points: Project filenames, paths, and local config.json files.
Boundary markers: None present to distinguish between data and instructions.
Capability inventory: Full Bash tool access for running local servers and launching applications.
Sanitization: Absent; the instructions rely on simple double-quoting which is insufficient to prevent command injection in most shell environments.
[EXTERNAL_DOWNLOADS]: The skill relies on grip, an external Python package, to render Markdown. It also makes network requests to the GitHub API (a well-known service) to perform this rendering. While these are legitimate dependencies for the stated purpose, the skill's lack of version pinning for grip introduces a minor supply chain risk.

open