The Agent Skills Directory

[COMMAND_EXECUTION]: The Node.js script located at scripts/agent-squad is vulnerable to command injection. In the startHeartbeats function, the script builds a shell command by interpolating the agent's name and role directly into a string executed via execSync. Because these inputs are not sanitized or escaped, a user or a malicious configuration could include shell metacharacters (e.g., semicolons, backticks, or pipes) in an agent's role to execute arbitrary code when the squad is started.
[COMMAND_EXECUTION]: The editAgent function in the management script uses execSync to launch a system editor defined by the EDITOR environment variable. While this is a common CLI pattern, the lack of validation on the file paths constructed from agent names could be exploited to manipulate the filesystem if agent names are crafted with path traversal or shell injection sequences.
[PROMPT_INJECTION]: The skill implements an 'indirect prompt injection' attack surface by design. The 'heartbeat' mechanism instructs agents to wake periodically and process content from external APIs (Linear, Trello, GitHub Issues). The instructions provided to the agents in startHeartbeats lack boundary markers or explicit safety directives, meaning an attacker who can comment on a linked task or issue could potentially override agent behavior or trigger unintended tool usage.
[PROMPT_INJECTION]: The evidence chain for the indirect injection vulnerability includes:
Ingestion points: External task systems (Linear, Trello, GitHub) via the linear, trello, and github skills.
Boundary markers: Absent in the heartbeatMsg construction.
Capability inventory: Agents have access to web search (ddg), deep reading (web_fetch), file management (github), and inter-agent communication (sessions_send).
Sanitization: None observed in the orchestration logic.

agent-squad