The Agent Skills Directory

[COMMAND_EXECUTION]: The SKILL.md file includes a middleware pattern that uses require() on a path resolved from user-supplied CLI arguments (argv.config). While common for configuration loading in CLI tools, this pattern can result in arbitrary code execution if an attacker provides a path to a malicious JavaScript file.
[COMMAND_EXECUTION]: The scripts/generate-completion.sh script executes the command name provided as the first shell argument to invoke the CLI and retrieve its completion definitions.
[COMMAND_EXECUTION]: The completion generation script allows writing output to an arbitrary file path provided as a script argument, which could potentially be used to overwrite sensitive files if run with elevated privileges.

yargs-patterns