The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's instructions in SKILL.md and the scripts/preflight.sh script execute a 'lint command' parsed directly from the user's initial request. This command is executed in the parent agent's shell environment without validation.
[DYNAMIC_EXECUTION]: The scripts/preflight.sh script uses the eval shell command to execute the $lint string. Because this string is derived from natural language input in the user's request, it allows a malicious actor to inject arbitrary shell commands (e.g., using command chaining with &&, ;, or |) that the agent will then execute.
[REMOTE_CODE_EXECUTION]: By allowing unvalidated user-supplied strings to be executed as shell commands, the skill creates a high-risk vector for arbitrary code execution. This could be used to download and execute malicious payloads or perform unauthorized network operations.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted target files and user-supplied commands with powerful capabilities but no sanitization.
Ingestion points: The target file is read and edited, and the lint command is parsed from the request (SKILL.md).
Boundary markers: Absent; the skill lacks delimiters or instructions to prevent the agent from following commands embedded within the document being fixed.
Capability inventory: The skill has arbitrary shell execution via eval (scripts/preflight.sh), file-write capabilities on the target, and the ability to delegate to other agents.
Sanitization: None; the lint command is passed to eval as a raw string.

codex-fix-prose