The Agent Skills Directory

[COMMAND_EXECUTION]: The instructions for the Bash tool in SKILL.md describe a process where user-provided text is directly interpolated into shell commands: codex exec --skip-git-repo-check -o "$TMPF" "<prompt>" and gemini -p "<prompt>". This pattern lacks shell escaping or sanitization, making the skill highly vulnerable to command injection. An attacker could provide a decision prompt containing shell metacharacters (e.g., ;, &, |, or backticks) to execute arbitrary system commands on the host machine.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input and uses it to drive both system-level operations and downstream LLM prompts, creating a significant attack surface.
Ingestion points: The user's "high-stakes decision" query described in SKILL.md.
Boundary markers: None. The use of double quotes in the shell commands is insufficient to prevent command injection and provides no protection against prompt injection for the downstream models.
Capability inventory: Access to Bash, Read, Write, Grep, and Glob tools.
Sanitization: No input validation or escaping mechanisms are specified before the data is executed in the shell.
[DATA_EXFILTRATION]: The command injection vulnerability provides a direct pathway for data exfiltration. Since the skill has access to the Bash tool and file system tools (Read, Glob), an attacker can use the injection vector to read sensitive files (such as environment variables, SSH keys, or cloud credentials) and transmit them to an external server using common utilities like curl or wget.

llm-council