The Agent Skills Directory

[COMMAND_EXECUTION]: The shell script in SKILL.md is vulnerable to command injection via the $ORG_NAME, $DOMAIN_SEL, and $SCOPE variables. Because the script uses an unquoted heredoc (<<EOF), any shell subcommands (e.g., $(id) or backticks) included in the user-provided inputs will be executed by the local shell during the report generation phase.
[DATA_EXFILTRATION]: Assessment results containing sensitive information about an organization's security gaps are saved to the /tmp directory. On multi-user systems, files in /tmp are often world-readable, which could allow unauthorized users to view the organization's security weaknesses.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted data that is subsequently used in a command-execution context.
Ingestion points: ORG_NAME, DOMAIN_SEL, and SCOPE variables in SKILL.md (Step 1).
Boundary markers: Absent; user input is interpolated directly into shell commands without delimiters or warnings.
Capability inventory: Shell script execution (bash), file writing (cat), and file reading (grep).
Sanitization: Absent; the script does not validate or escape user input before processing.

isms-checklist