The Agent Skills Directory

[COMMAND_EXECUTION]: The 'Workflow Example' script in SKILL.md contains a critical command injection vulnerability. It processes external JSON requests from a network-connected listener (pilotctl recv) and interpolates fields like $BUCKET, $KEY, and $ACTION directly into shell commands (aws s3 cp, aws s3 ls) without any sanitization or validation. An attacker could use backticks or subshell syntax in these fields to execute arbitrary code on the host.
Ingestion points: Data enters through pilotctl --json recv on port 1008.
Sanitization: None. The script uses raw jq output in string interpolation for shell execution.
Capability inventory: The script has the ability to execute aws s3 commands and pilotctl messaging, and it runs a public daemon.
[CREDENTIALS_UNSAFE]: The documentation instructs users to hardcode highly sensitive credentials (AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY) directly into the bridge script. This practice, combined with the command execution vulnerability, significantly increases the risk of credential theft.
[DATA_EXFILTRATION]: The lack of input validation allows for exfiltration of the hardcoded credentials and other environment variables. An attacker can manipulate the pilotctl send-message or aws s3 commands to send sensitive data to an external location.
[PROMPT_INJECTION]: There is a discrepancy in author metadata; README.md identifies the author as TeoSlayer, while SKILL.md identifies the author as vulture-labs. This inconsistency in attribution can be misleading regarding the skill's origin and security responsibility.

pilot-s3-bridge