The Agent Skills Directory

COMMAND_EXECUTION (HIGH): The scripts/sidequest.sh script is vulnerable to command injection via shell metacharacters.
The script uses osascript to launch a new terminal and execute a command: cd '$PWD' && claude -p "$escaped_prompt".
The $escaped_prompt variable, which contains the user-provided task description, is passed through escape_for_applescript. However, this function only escapes double quotes and backslashes. It does not escape shell-active characters like $ (dollar sign) or ` (backticks).
An attacker can provide a task description containing shell substitutions (e.g., $(touch /tmp/pwned)) which will be executed by the shell in the newly spawned terminal session.
Additionally, the $PWD variable is used inside single quotes in cd '$PWD'. If a user is in a directory with a name containing a single quote followed by shell commands, this would also lead to command injection.
DATA_EXFILTRATION (LOW): The skill gathers local system context (current working directory, git branch, and recent file activity) and passes it to an external process (claude CLI). While this is the intended functionality, it constitutes a crossing of session boundaries for sensitive environment data.
PROMPT_INJECTION (LOW): The skill is susceptible to indirect prompt injection. It ingests data from untrusted sources such as git branch names and recent file content, which are then interpolated into the system prompt of the new Claude session without sufficient sanitization or boundary markers.

sidequest