The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The scripts/swain-stage.sh script contains a suggested command for installing the micro editor using curl https://getmic.ro | bash when the tool is not found. While getmic.ro is the official distribution site for this well-known editor, piping remote scripts directly into a shell is a security anti-pattern as it executes unverified code.
[COMMAND_EXECUTION]: The scripts/swain-stage.sh script constructs and executes shell commands in tmux panes using values resolved from swain.settings.json and references/layouts/*.json. Specifically, the editor setting is interpolated into shell commands without sanitization or shell escaping in the cmd_layout and cmd_pane functions. This creates a vulnerability surface where a malicious configuration file in a repository could trigger arbitrary command execution. Additionally, scripts/swain-motd.py uses f-string interpolation for repository paths in shell commands, which could be problematic if paths contain shell meta-characters.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8) where malicious configuration data in a repository can influence agent capabilities and lead to command execution.
Ingestion points: The skill reads settings from swain.settings.json and layout definitions from repository files.
Boundary markers: No delimiters or "ignore embedded instructions" warnings are used when processing these settings.
Capability inventory: The skill executes shell commands via tmux split-window across multiple scripts.
Sanitization: No shell escaping or validation is applied to the editor configuration string before it is passed to the shell.

swain-stage