The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to construct command strings for the exec tool using shell interpolation, such as opencode run --model <MODEL> "$(cat PROMPT.md)". This practice is insecure as it allows for command injection if the file content (which originates from user input or project files) contains malicious shell commands or subshell execution sequences.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted data from project files and passes it to subsequent AI agents without adequate isolation or sanitization. (1) Ingestion points: specs/*.md, IMPLEMENTATION_PLAN.md, PROMPT.md, AGENTS.md. (2) Boundary markers: The prompt templates lack explicit security boundaries or instructions to the secondary agents to ignore instructions embedded within the processed files. (3) Capability inventory: The agent has access to exec, process, file-read, and file-write tools, providing a wide range of actions that could be exploited via injection. (4) Sanitization: There is no evidence of sanitization or character escaping for content retrieved from files before it is used in command construction or agent prompts.
[PRIVILEGE_ESCALATION]: The documentation encourages the use of high-risk 'auto-approval' flags like --yolo and --dangerously-skip-permissions. These flags explicitly disable security guardrails and permission prompts in the orchestrated coding agents, which can lead to unauthorized file system changes or network activity if the agent is misled by malicious input.
[DYNAMIC_EXECUTION]: The skill generates shell command strings at runtime by concatenating user-influenced file contents with CLI commands, which are then executed via the exec tool. This dynamic assembly of executable strings from external content is a significant security risk.

ralph-loop