The Agent Skills Directory

[COMMAND_EXECUTION]: The urlencode function in scripts/qiita.sh is vulnerable to command injection via its use of python3 -c. The function interpolates the $string shell variable directly into a Python command string using triple quotes ('''$string'''). An attacker can break out of the string literal by including triple quotes in the input, allowing for the execution of arbitrary Python code and shell commands.
Evidence: python3 -c "import urllib.parse; print(urllib.parse.quote('''$string''', safe=''))" in scripts/qiita.sh.
Impact: Since the agent uses this script to process article titles, tags, and search queries—data which can be controlled by third parties on Qiita—this vulnerability could lead to a system compromise when the agent interacts with malicious content.
[PROMPT_INJECTION]: The skill fetches and processes technical articles and comments from the Qiita platform, which are external, user-generated sources. This introduces a surface for indirect prompt injection attacks.
Ingestion points: scripts/qiita.sh retrieves article content and metadata from https://qiita.com/api/v2 across multiple commands including item search and comment list.
Boundary markers: Absent. The agent receives the external content without delimiters or specific instructions to ignore embedded commands.
Capability inventory: The script can read arbitrary local files via the --body-file parameter in cmd_item_post and perform write or delete actions on articles and comments.
Sanitization: Absent. The script lacks sanitization for the natural language content it retrieves, relying only on structural JSON formatting via jq and URL encoding for parameters.

qiita