The Agent Skills Directory

[COMMAND_EXECUTION]: The workflow in SKILL.md directly interpolates user-controlled variables {data_type} and {context} into python3 commands executed via the Bash tool. Specifically, the command python3 -m lens_agent.uiux search --domain chart --query "{data_type}" is susceptible to command injection if a user provides input containing shell metacharacters like backticks, semicolons, or command substitution patterns (e.g., $(...)). This could allow an attacker to execute arbitrary code on the system running the agent.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it processes external data from a knowledge base search to fulfill user requests.
Ingestion points: User input {data_type} and {context} are used to fetch data from lens_agent.uiux (referenced in SKILL.md).
Boundary markers: There are no boundary markers or instructions to the agent to ignore potentially malicious content within the search results.
Capability inventory: The skill uses the Bash tool to run Python modules, providing a mechanism for code execution if the ingested data is malicious.
Sanitization: No sanitization or validation of the search results or user input is performed before processing.

lens-chart