The Agent Skills Directory

[COMMAND_EXECUTION]: The skill configuration in SKILL.md requests the Bash(cmd:*) permission, which allows the execution of any system command. This broad access level poses a significant risk if the agent's behavior is influenced by malicious input.
[REMOTE_CODE_EXECUTION]: The script assets/example_code_vulnerable.py includes functional code for command injection using subprocess.run(shell=True). While labeled as an example, this function is executed when the script is run and can be leveraged to execute arbitrary code on the host system.
[REMOTE_CODE_EXECUTION]: The assets/example_code_vulnerable.py script contains a demonstration of insecure deserialization using pickle.loads(). Although the specific execution is commented out, the presence of this pattern in an executable script is a security concern.
[DATA_EXFILTRATION]: The path_traversal_example function in assets/example_code_vulnerable.py is functional and allows reading arbitrary files by manipulating path components. The script demonstrates this by attempting to access files outside its intended directory.
[PROMPT_INJECTION]: The skill is designed to analyze external, untrusted code, making it vulnerable to indirect prompt injection (Category 8).
Ingestion points: Processes user-provided code for security analysis as defined in SKILL.md.
Boundary markers: No delimiters or instructions are present to prevent the agent from following commands embedded in the audited code.
Capability inventory: Access to Bash, Write, Edit, and Grep provides a powerful set of tools for an attacker.
Sanitization: There is no evidence of input validation or content sanitization before processing audited files.

performing-security-code-review