The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to construct and execute shell commands using variables derived from web searches or user input, such as git clone [repo-url] /tmp/docs-analysis. This creates a command injection vulnerability where a maliciously crafted repository URL or library name containing shell metacharacters could lead to arbitrary command execution on the host system.
[DYNAMIC_EXECUTION]: The skill performs system-altering actions including global package installation (npm install -g repomix) and repository cloning to the /tmp directory. It then executes commands (repomix) on the contents of these downloaded repositories. This combination of global installation and execution of third-party code from external sources significantly increases the attack surface.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process large volumes of untrusted data from documentation sites and code repositories. It lacks explicit instructions for the agent to use boundary markers or sanitization logic (e.g., XML/Markdown escaping), making it vulnerable to indirect prompt injection where an attacker could embed malicious instructions inside documentation to manipulate the agent's behavior during the extraction phase.
Ingestion points: WebFetch of documentation URLs, git cloning of repositories, and reading Repomix XML output (SKILL.md Phase 2 and 3).
Boundary markers: None specified in the instructions.
Capability inventory: npm installation, git cloning, and shell command execution.
Sanitization: No evidence of sanitization or validation of the ingested documentation content before processing.
[EXTERNAL_DOWNLOADS]: The workflow relies heavily on context7.com, a third-party documentation aggregator, and automatically clones repositories from GitHub based on search results. While these platforms are widely used, the skill lacks mechanisms to verify the integrity or safety of the content being downloaded and executed.

docs-seeker