The Agent Skills Directory

[COMMAND_EXECUTION]: The skill takes user-provided arguments (docs-file and rule-skill) and interpolates them directly into shell commands within the Bash tool instructions. Specifically, in Step 3 and Step 4, the commands git add <docs-file>, git commit, and sbt "docs/mdoc --in <docs-file>" use these inputs without any sanitization or validation. An attacker could provide a malicious string containing shell metacharacters (e.g., ; rm -rf / ;) to execute arbitrary commands on the host system.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to read and process the full content of documentation files (docs-file) which are untrusted external inputs. It then performs edits and executes commands based on its analysis of this content, creating a significant attack surface for indirect prompt injection.
Ingestion points: The Read tool is used to ingest the entire content of the file specified by the docs-file argument in Step 2.
Boundary markers: The skill lacks any boundary markers or instructions for the agent to ignore or delimit potentially malicious instructions embedded within the documentation text.
Capability inventory: The skill possesses powerful capabilities including file modification via the Edit tool and shell command execution via the Bash tool (git operations and sbt compilation).
Sanitization: There is no evidence of sanitization, escaping, or validation of the documentation content before it is processed by the agent's logic.

docs-check-compliance