The Agent Skills Directory

[COMMAND_EXECUTION]: Unsafe interpolation of user-controlled variables into shell commands. In SKILL.md, the HASH_VALUE variable is passed to the hashid tool within a shell script without sanitization or proper quoting. A malicious input containing shell metacharacters (e.g., ;, &, or backticks) could allow an attacker to execute arbitrary shell commands.
[COMMAND_EXECUTION]: Dynamic script generation and execution using unsanitized user input. The skill uses a shell heredoc in SKILL.md to generate and run a Python script at runtime. The variables ${PLAINTEXT} and ${HASH_VALUE} are expanded by the shell and inserted directly into the Python source code. This enables both shell command injection during expansion (e.g., via $(...)) and Python code injection if the input values contain quotes or other escape characters.
[EXTERNAL_DOWNLOADS]: Installs the hashid utility from the official Python Package Index (PyPI) via pip.

hash-identify