The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill uses dynamic context injection (!) in SKILL.md to execute scripts/context.sh at load time. This script receives $ARGUMENTS directly from the user or agent interaction without validation.
[COMMAND_EXECUTION]: Inside scripts/context.sh, the skill processes the user-supplied arguments and executes them using eval "$lint". Because the $lint variable is constructed from raw input, an attacker can provide a string that escapes the intended command and executes arbitrary shell commands on the host system during the skill load phase.
[INDIRECT_PROMPT_INJECTION]: The skill processes the content of a target file and the output of the linting command, injecting both into the agent's context. This creates a surface for instructions embedded in documents to influence agent behavior.
Ingestion points: scripts/context.sh reads the user-specified target file and captures stdout/stderr from the user-controlled lint command.
Boundary markers: The script uses basic text headers (e.g., == findings ==) to delimit sections, which can be easily bypassed by adversarial content within the ingested files.
Capability inventory: The skill is designed to perform file modifications and execute shell commands (mise, vale, and the user-defined lint command).
Sanitization: No sanitization, escaping, or filtering is applied to the content of the target file or the command output before injection into the prompt.

write-prose-fix