The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The SKILL.md file employs the Claude Code dynamic context syntax !command`` to execute a bash script at skill load time. Specifically, it uses !bash ${CLAUDE_SKILL_DIR}/scripts/preflight.sh $ARGUMENTS. Because $ARGUMENTS contains user-supplied input that is interpolated directly into a shell command line, an attacker or a malicious prompt could inject additional shell commands (e.g., via semicolons or backticks) that execute immediately when the skill is accessed.
[COMMAND_EXECUTION]: The scripts/preflight.sh script takes the lint command provided in the skill arguments and executes it using eval "$lint". This is a significant security risk as it allows for arbitrary shell command execution. There is no sanitization or validation performed on the $lint variable before it is passed to the shell evaluator.
[INDIRECT_PROMPT_INJECTION]: The skill has a large attack surface for indirect prompt injection.
Ingestion points: The skill reads target files and user-supplied lint commands in preflight.sh. It also relies on a findings file (fix-prose.notes) written to the git directory.
Boundary markers: There are no clear delimiters or instructions provided to the sub-agents to ignore potentially malicious instructions embedded within the prose findings or the files being processed.
Capability inventory: The skill scripts have the ability to read and write files within the .git directory, execute arbitrary shell commands via eval, and manage process locks.
Sanitization: No sanitization is performed on the findings text or the lint commands before they are processed or executed.

fix-prose