The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Bash tool to execute a Python module with user-provided arguments in a shell string: python3 -m pitch_agent.uiux search --domain landing --query "{product_type}" --limit 3.
Vulnerability: The {product_type} variable, which is derived from user input or established context, is interpolated directly into the shell command.
Evidence: Found in the 'Design Intelligence' section of SKILL.md.
Risk: Although the query is wrapped in double quotes, it does not prevent command substitution via backticks or $(). A malicious user could provide a product type that executes arbitrary system commands.
[PROMPT_INJECTION]: The skill facilitates an indirect prompt injection surface by using external tools to gather content that influences the agent's behavior.
Ingestion points: External data is retrieved via WebFetch and WebSearch (e.g., to match brand voice).
Boundary markers: There are no explicit instructions or delimiters used to separate fetched content from internal instructions, increasing the risk that the agent will follow malicious instructions embedded in web content.
Capability inventory: The agent has access to sensitive tools such as Bash, Write, and Edit, which could be abused if the agent's logic is hijacked by external data.
Sanitization: No sanitization or validation of external content is performed before it is processed by the agent.
[EXTERNAL_DOWNLOADS]: The skill defines WebFetch and WebSearch as allowed tools. While used for legitimate research into product positioning and brand voice, these tools allow the agent to download and process data from arbitrary, potentially untrusted external domains.

pitch-copy