The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect injection because it processes user-supplied data that influences the execution of shell scripts.
Ingestion points: The variables ORG_NAME and SCOPE are defined in SKILL.md and populated via user input.
Boundary markers: No delimiters or warnings are used to prevent the agent or the shell from interpreting instructions embedded within these variables.
Capability inventory: The skill uses shell script blocks to perform file writing (cat >) and text processing (grep, head).
Sanitization: The inputs are interpolated directly into a bash heredoc without any escaping or validation logic.
[COMMAND_EXECUTION]: In SKILL.md (Step 1), the bash script uses an unquoted heredoc (<<EOF) to generate the report. This allows the shell to expand variables and execute subshells within the string. If a user provides an input like $(whoami) for the ORG_NAME, the command will be executed when the script runs.
[DATA_EXFILTRATION]: The generated gap analysis report, which contains sensitive information about an organization's security posture and personal data processing, is saved to the /tmp directory (/tmp/isms_check_*.md). This may result in unauthorized data exposure on multi-user or shared systems where the temporary directory is globally readable.

isms-checklist