The Agent Skills Directory

[DYNAMIC_EXECUTION]: In scripts/xy-sync.sh, the cmd_push function executes git commit -m "$msg". Because $msg is wrapped in double quotes in a shell script, any shell metacharacters (such as backticks or $(...)) present in the commit message will be expanded and executed by the shell. This allows for arbitrary command execution if the commit message, which is generated by the agent based on user-provided or file-based change descriptions, is maliciously crafted.
[INDIRECT_PROMPT_INJECTION]: The cmd_check_remote function in scripts/xy-sync.sh fetches a JSON file from a remote URL and extracts a notice field, which is then printed to the user/agent. A compromised update server could inject instructions into this field to influence the agent's future actions.
Ingestion points: Content is fetched from XY_UPDATE_URL or ~/.xy/config.json via curl in scripts/xy-sync.sh.
Boundary markers: The notice text is output directly to the agent without any delimiters or instructions to ignore embedded commands.
Capability inventory: The skill possesses capabilities for file system modification (soft links), Git repository operations (push/pull), and shell script execution.
Sanitization: The retrieved notice string is not sanitized or escaped for potential prompt injection patterns before being displayed.
[EXTERNAL_DOWNLOADS]: The skill uses curl to download a version manifest from an external URL during the update check process. This introduces a dependency on the availability and integrity of an external network resource.
[COMMAND_EXECUTION]: The skill frequently invokes external binaries and scripts (e.g., python3, bash, git, curl) via shell commands. This creates a broad attack surface for potential exploitation if any of the inputs or local environment variables are compromised.

xy-sync