The Agent Skills Directory

[COMMAND_EXECUTION]: The skill frequently executes shell commands via subprocess.run to gather system information. This includes running pip list, npm list, and code --list-extensions in agentforge/scanner/tools.py, as well as executing the claude CLI in agentforge/llm.py to interact with the LLM.
[DATA_EXFILTRATION]: The ToolScanner in agentforge/scanner/tools.py reads sensitive local configuration files, specifically ~/.claude/claude_desktop_config.json and other Claude Desktop configuration paths. These files often contain API keys or environment variables for MCP servers. While the current logic primarily extracts server names, the entire file is parsed into memory, and the resulting system profile is sent to the LLM.
[REMOTE_CODE_EXECUTION]: The MVPBuilder in agentforge/mvp/builder.py is designed to generate complete, runnable Python project skeletons. This involves dynamic code generation where the file content is determined by LLM output. Executing the generated code (as suggested by the setup instructions) could lead to arbitrary code execution if the LLM output is compromised.
[PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection in agentforge/collector/data.py. It fetches open issue titles from arbitrary GitHub repositories and interpolates them directly into a JSON structure that is passed to the LLM. An attacker could place a malicious instruction in a GitHub issue title to influence the project brief or generated code.
Ingestion points: agentforge/collector/data.py (Fetches issue titles from api.github.com/repos/{repo}/issues).
Boundary markers: The untrusted data is encapsulated in a JSON object within a markdown block, providing moderate isolation but no strict sanitization.
Capability inventory: The skill can execute shell commands (subprocess.run in llm.py), write files to the local filesystem (mvp/builder.py), and make outbound network requests (collector/data.py).
Sanitization: No sanitization or filtering is performed on the GitHub issue titles before they are processed by the LLM.

agentforge