The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the agent to execute Python scripts via the shell, interpolating user-provided variables directly into the command strings.
Evidence: python scripts/dfs_client.py ideas --keyword "<seed>" and python scripts/dfs_client.py ranked --target "<user-domain>".
Risk: If a user provides a seed topic or domain containing shell metacharacters (e.g., ;, &, |), it could lead to arbitrary command execution on the host system.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user data and uses it to drive high-capability tools (shell execution).
Ingestion points: The seed topic, keyword list, and user-domain provided by the user in chat or files (SKILL.md).
Boundary markers: Absent. There are no instructions for the agent to validate, escape, or sanitize these inputs before passing them to the shell.
Capability inventory: The skill utilizes python to execute local scripts (dfs_client.py, report_publish.py) and writes to the filesystem using the SEO_REPORTS_DIR environment variable.
Sanitization: Absent. The process lacks any sanitization or validation steps for external content before interpolation.
[EXTERNAL_DOWNLOADS]: The skill references and depends on external Python scripts (scripts/dfs_client.py and scripts/report_publish.py) that are not included in the analyzed file. The behavior and safety of these scripts cannot be verified.

topic-clustering