The Agent Skills Directory

[COMMAND_EXECUTION] (HIGH): The instruction yarn flow $ARGUMENTS directly interpolates a user-controlled variable into a shell command. An attacker could inject command separators (e.g., ;, &&, |) or shell substitutions to execute unauthorized background processes.
[Indirect Prompt Injection] (HIGH): Vulnerability detected in the handling of untrusted input.
Ingestion points: The $ARGUMENTS variable defined in SKILL.md accepts input from the agent context.
Boundary markers: Absent. The variable is placed directly in the command string.
Capability inventory: Execution of subprocesses via yarn (file system access and potentially network access depending on scripts).
Sanitization: Absent. No escaping or validation of the $ARGUMENTS string is performed before execution.

flow