The Agent Skills Directory

[COMMAND_EXECUTION]: The shell execution pattern defined in SKILL.md for workspace.sh passes the $ARGUMENTS placeholder directly to the command line without quoting or sanitization. This allows for shell metacharacter injection (e.g., using ;, |, or &), which could lead to unauthorized command execution.
[REMOTE_CODE_EXECUTION]: The command injection vulnerability in the script execution logic creates a risk of remote code execution if an attacker can influence the arguments provided to the skill, potentially allowing for the download and execution of malicious payloads.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting and processing data from the local environment.
Ingestion points: The skill reads directory names and Git remote URLs from the local filesystem in setup-workspace.sh, setup-workspace.ps1, and workspace.sh during the discovery phase.
Boundary markers: No explicit delimiters or instructions are provided to the agent to treat the discovered repository metadata as untrusted data, increasing the risk that the agent may follow instructions embedded in directory names or remote URLs.
Capability inventory: The skill has permissions to create directories, modify .gitignore, and manipulate the Git index via git submodule add and git rm --cached.
Sanitization: The setup-workspace.sh script performs minimal escaping of double quotes when building JSON output, which does not protect against more sophisticated injection techniques designed to alter the agent's logic flow.

workspace