The Agent Skills Directory

[COMMAND_EXECUTION]: Shell command injection vulnerability identified in the workflow. The script interpolates the $ISSUE_ID variable—which the instructions state is provided via the user prompt—directly into the bash command bd show "$ISSUE_ID" --json. A malicious user could provide a crafted ID containing shell metacharacters (e.g., $(rm -rf /)) to execute arbitrary code with the agent's privileges.
[COMMAND_EXECUTION]: The skill's use of the Bash tool with capabilities to create directories, write files, and execute external commands (such as git and bd) increases the potential impact of the command injection vulnerability.

docs-check