The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses eval to execute the output of a local binary located at ~/.vibestack/bin/vibe-slug. This pattern is dangerous as it allows the tool to execute arbitrary shell commands if the binary's output is influenced by project names, directory structures, or git metadata containing shell metacharacters.
[COMMAND_EXECUTION]: The skill constructs shell commands for subagents by interpolating a {brief} variable directly into a command string: {$D path} generate --brief "{brief}". Since the brief is populated using unsanitized content from local files (such as DESIGN.md) and direct user responses, an attacker can achieve command injection by providing a payload containing command separators (e.g., "; rm -rf /; #").
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting data from the local environment and user interactions and passing it to subagents without validation.
Ingestion points: DESIGN.md, learnings.jsonl, file listings (src/, app/), and user responses via AskUserQuestion.
Boundary markers: The skill does not use delimiters or instructions to ignore embedded commands when interpolating data into the subagent's prompt.
Capability inventory: The skill uses the Bash tool for local execution and the Agent tool to run subagents with shell access.
Sanitization: No escaping, filtering, or validation is performed on the gathered context before it is used in command line arguments.
[COMMAND_EXECUTION]: The skill starts a local web server ($D compare ... --serve) and subsequently interacts with it using curl to send POST requests containing file paths. These paths are derived from project metadata and user-supplied names, which could be manipulated to target different files on the system through the local server interface.

design-shotgun