The Agent Skills Directory

[COMMAND_EXECUTION]: The skill performs unsafe string interpolation of user-provided tokens into shell commands. In SKILL.md, Step 1 executes a python3 -c one-liner that directly embeds a token value. This allows for arbitrary code execution if the token contains a single quote followed by malicious Python commands.
[COMMAND_EXECUTION]: The bundled script scripts/validate_secret.py contains a command injection vulnerability in the test_env_injection function. It interpolates the user-provided secret_name directly into a python3 -c string executed via subprocess.run. A specially crafted secret name could break out of the string context to execute arbitrary code within the Python process.
[DATA_EXFILTRATION]: The scripts/test_api_auth.py script accepts a user-provided --api-url and proceeds to send the retrieved secret as an Authorization: Bearer token to that endpoint. This pattern can be exploited to exfiltrate secrets to an attacker-controlled server by simply providing a malicious URL as input.
[DYNAMIC_EXECUTION]: The skill frequently uses python3 -c to execute dynamically constructed code blocks at runtime. It also recommends using the mise tool's exec feature to dynamically fetch secrets, which involves executing shell commands to populate environment variables during configuration loading.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection:
Ingestion points: User-provided inputs for SECRET_NAME, TOKEN_VALUE, PROJECT, CONFIG, and API_URL are used throughout the workflow.
Boundary markers: None identified; inputs are interpolated directly into prompts and shell commands.
Capability inventory: The skill has Bash and Read tools, and executes shell commands via subprocess.run and direct CLI calls.
Sanitization: No input validation or sanitization is performed on the provided variables before they are used in sensitive contexts.

doppler-secret-validation