The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/run-activation-audit.sh is vulnerable to command injection. It uses node's child_process.execSync to execute grep commands where the search pattern is derived directly from filenames in the src/agents/ directory. Because the filename is interpolated into the shell command string without sanitization, an attacker who can place a file in that directory (e.g., a file named ; touch RCE ;.md) can achieve arbitrary command execution when the audit script is run.
[REMOTE_CODE_EXECUTION]: The skill includes a shell script that executes a complex Node.js one-liner. This script performs dynamic filesystem operations and executes further shell commands based on repository content, creating a dangerous execution chain that trusts the local environment implicitly.
[DATA_EXFILTRATION]: The skill is designed to read and process sensitive telemetry logs from .claude/logs/subagent-spawns.jsonl. These logs contain detailed information about agent usage, session IDs, and internal task routing, which are then summarized and output to the user's terminal.
[PROMPT_INJECTION]: The skill has an indirect prompt injection surface because it processes untrusted telemetry data without sanitization.
Ingestion points: scripts/run-activation-audit.sh reads and parses .claude/logs/subagent-spawns.jsonl.
Boundary markers: No boundary markers or instructions to ignore embedded commands are present in the processing logic.
Capability inventory: The skill utilizes Bash for script execution and TaskCreate/TaskUpdate for task management based on the telemetry findings.
Sanitization: There is no evidence of sanitization or filtering of the telemetry data before it is incorporated into the audit report.

audit-activation