The Agent Skills Directory

[COMMAND_EXECUTION] (HIGH): Vulnerability to shell command injection in utility scripts.
Evidence:
File: scripts/docker-build.sh (Line 158) executes eval $DOCKER_CMD. The variable $DOCKER_CMD is built from multiple input arguments such as IMAGE_NAME, TAG, and BUILD_ARGS without sanitization.
File: scripts/docker-run.sh (Line 183) executes eval $DOCKER_CMD. The variable is constructed using arguments like CONTAINER_NAME, IMAGE_NAME, and VOLUMES without validation.
Impact: If an AI agent or user passes untrusted data (e.g., a project name derived from an external PR title) to these scripts, an attacker could execute arbitrary code on the host machine using shell metacharacters (e.g., ;, &, |, `).

docker-containerization