The Agent Skills Directory

[COMMAND_EXECUTION]: The script find-polluter.sh executes npm test on files discovered on the local file system. This allows the skill to run arbitrary tests found in the repository.
[INDIRECT_PROMPT_INJECTION]: The find-polluter.sh utility is vulnerable to shell command injection. The TEST_PATTERN variable is interpolated directly into a find command string without sanitization. An attacker who can influence the input pattern could inject find flags such as -exec to execute arbitrary commands or use shell metacharacters to subvert the command execution logic.
Ingestion points: find-polluter.sh (CLI argument TEST_PATTERN used in file discovery)
Boundary markers: Absent. The variable is used directly in a subshell interpolation.
Capability inventory: File system search (find) and local test execution (npm test).
Sanitization: Absent. No escaping or validation is performed on the input pattern before use in the shell command.

systematic-debugging