The Agent Skills Directory

[DYNAMIC_EXECUTION]: The provided initialization script scripts/init-project.sh is vulnerable to shell command injection. The script uses unquoted Heredoc delimiters (<<EOF) to create several project files, such as project.md and phase-state.md. In bash, unquoted Heredocs allow the shell to expand variables and evaluate command substitutions (e.g., $(command)) within the block. The SKILL.md instructions explicitly direct the agent to execute this script using user-controlled strings for the project title and directory, which could lead to arbitrary code execution if the input is not sanitized.
[COMMAND_EXECUTION]: The skill instructs the agent to execute a provided shell script (init-project.sh) using parameters provided by the user. This creates a direct path for command injection as described in the dynamic execution findings.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data, specifically raw interview transcripts, survey exports, and research notes.
Ingestion points: The skill reads files from the research/raw/ directory to extract observations.
Boundary markers: While the skill implements a disciplined tagging system ([S#]), it lacks explicit instructions to the agent to ignore or neutralize potential prompt injection attacks embedded within the research data.
Capability inventory: The agent has the capability to write to the filesystem, execute scripts, and potentially invoke other skills, providing a target for malicious instructions hidden in the ingested data.
Sanitization: There is no evidence of sanitization or filtering applied to the raw user data before the agent processes it for synthesis.

design-thinking