The Agent Skills Directory

[COMMAND_EXECUTION]: The skill interpolates user-controlled arguments (spec_path, project_dir, and fixture_class_path) directly into bash command blocks in Step 3 and Step 6. If a user provides an argument containing shell metacharacters (e.g., ;, &, |), it could lead to arbitrary command execution on the host system.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted data from external sources and passes it to secondary agents.
Ingestion points: The skill reads content from {spec_path}/spec.json, {spec_path}/pages/*.html, and {spec_path}/values/*.json in Step 1 and Step 4.
Boundary markers: There are no boundary markers or instructions telling the agent to ignore embedded instructions within the processed data.
Capability inventory: The skill has access to the Bash tool, Write tool, and the ability to trigger code generation agents (/scrape-codegen-analyze, /scrape-codegen-generate).
Sanitization: There is no evidence of sanitization or validation of the content read from the external spec files before they are processed by the agent.

scrape-codegen