The Agent Skills Directory

[COMMAND_EXECUTION] (MEDIUM): The skill's primary workflow relies on the agent executing shell commands (python3 scripts/search.py) to interact with its database, which increases the attack surface if the agent is given broad shell access.
[PRIVILEGE_ESCALATION] (MEDIUM): The SKILL.md file contains instructions for system-level changes using elevated privileges (sudo apt update && sudo apt install python3). While intended for setup, suggesting sudo commands is a high-risk pattern for automated agents.
[EXTERNAL_DOWNLOADS] (LOW): The setup guide recommends downloading software via system package managers (brew, apt, winget). While these are trusted sources, the action involves external network requests and system modifications.
[INDIRECT_PROMPT_INJECTION] (LOW): The skill ingests data from local CSV files and interpolates it into the agent's context without sanitization or clear boundary markers.
Ingestion points: scripts/core.py reads from data/*.csv files based on user-provided keywords.
Boundary markers: The format_output function in scripts/search.py uses simple headers (e.g., ### Result i) but lacks strict delimiters to prevent the agent from interpreting CSV content as new instructions.
Capability inventory: The agent is already tasked with executing shell commands, which could be exploited if malicious content is placed in the CSV files.
Sanitization: No validation or escaping is performed on the data retrieved from the CSVs before it is displayed to the agent.

ui-ux-pro-max