The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/full-audit.sh is vulnerable to local command injection. It uses shell variable interpolation to pass output from sub-scripts into a python3 -c command string using triple quotes. Evidence: The line images = json.loads('''$image_result''') in full-audit.sh allows a project filename containing ''' to break out of the Python string context and execute arbitrary Python code.
[COMMAND_EXECUTION]: The skill relies on local execution of several shell scripts and Unix utilities including find, stat, gzip, and sips (on macOS). These operations are restricted to the project directory provided by the user but represent a significant execution capability.
[SAFE]: The skill operates entirely locally and does not request or use network access, which prevents remote data exfiltration risks.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data from project files and presents it to the agent without boundary markers.
Ingestion points: Project file paths in scripts/image-audit.sh and scripts/bundle-audit.sh, and package.json content in scripts/dep-audit.sh.
Boundary markers: Absent in script output.
Capability inventory: Local file system read access and subprocess execution via bash and python3.
Sanitization: The skill uses sed to escape double-quotes for JSON formatting in individual scripts, but fails to safely handle the resulting data interpolation in the full-audit.sh script.

perf-audit