The Agent Skills Directory

[COMMAND_EXECUTION]: The skill constructs a shell command using the Bash tool to create a Pull Request: gh pr create --title '{pr_title}' --body @- <<< '{pr_body}'. The pr_body variable contains data derived from the external handoff bundle (such as bundle_url, bundle_id, and component metadata). Since this data is not sanitized, a malicious bundle could include shell-breaking characters like single quotes to terminate the intended string and execute arbitrary commands on the host machine.
[PROMPT_INJECTION]: The skill uses the Agent tool to call sub-agents (ork:test-generator and ork:expect-agent) with prompts that include data from the imported bundle. Without boundary markers or explicit instructions to ignore embedded commands, malicious instructions within the design bundle could override the intended behavior of these sub-agents.
[DATA_EXFILTRATION]: Through the command injection vulnerability, an attacker could read sensitive local information (such as .env files, AWS credentials, or SSH keys) and either include them in the generated PR body or exfiltrate them to an external server.
[EXTERNAL_DOWNLOADS]: The skill fetches design handoff bundles from claude.ai, which is a well-known service.
[PROMPT_INJECTION]: The skill has a high surface area for indirect prompt injection. 1. Ingestion points: The handoff URL and the imported bundle JSON file. 2. Boundary markers: None are present in the prompts passed to sub-agents. 3. Capability inventory: The skill has extensive permissions including Bash execution, filesystem Write access, and the ability to delegate tasks to other Agent instances. 4. Sanitization: There is no evidence of input validation, escaping of shell characters, or prompt-injection-specific sanitization.

design-ship