The Agent Skills Directory

[COMMAND_EXECUTION]: The validation script scripts/validate.sh is vulnerable to Python script injection. It interpolates the $SPEC_PATH shell variable directly into a single-quoted Python string literal within a python3 -c command. A maliciously crafted filename (e.g., test.json' + __import__('os').system('whoami') + ') would escape the literal and execute arbitrary Python code.
[PROMPT_INJECTION]: The skill is designed to process untrusted external data (API specifications). This introduces an indirect prompt injection surface where instructions embedded in a specification's metadata or descriptions could manipulate agent behavior.
Ingestion points: User-provided OpenAPI, GraphQL, or gRPC specification files as defined in SKILL.md.
Boundary markers: None; the agent is instructed to review the full content of provided specifications without explicit isolation.
Capability inventory: Subprocess execution via scripts/validate.sh and general analytical reasoning.
Sanitization: None; the validation script checks for file format but does not sanitize content for embedded instructions.
[SAFE]: The validate.sh script correctly utilizes yaml.safe_load() for YAML parsing, adhering to best practices to prevent YAML-based deserialization attacks.

api-contract-auditor