The Agent Skills Directory

[COMMAND_EXECUTION]: The runOpencode function in index.js uses child_process.spawn to execute the opencode CLI. On Windows systems, the code invokes cmd.exe /c, which is susceptible to command injection. Malicious Discord messages containing shell metacharacters (e.g., &, |, ^) could be interpreted by the shell and lead to arbitrary code execution.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. It ingests untrusted user content from Discord messages in index.js and passes it directly to the AI-driven opencode tool without employing boundary markers or 'ignore' instructions. This allows attackers to potentially override the agent's behavior through crafted messages.
[COMMAND_EXECUTION]: The SKILL.md file provides instructions for the agent to execute shell commands via npx dm-bot. This grants the agent direct capability to manipulate the local SQLite database and filesystem based on its interpretation of user requests, increasing the impact of any successful prompt injection attack.

dm-bot