The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The script scripts/main.cjs modifies JavaScript routing tables by directly interpolating the skill argument into a single-quoted string within a configuration file. Because the input is not escaped, it allows for property injection or arbitrary code execution when the agent loads its routing configuration.
[EXTERNAL_DOWNLOADS]: The skill specifies a mandatory research phase using WebFetch to query the arXiv API and utilizing the Exa search tool. These operations target well-known academic and technology services.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection by placing unsanitized user input into generated command files and catalogs.
Ingestion points: Arguments name, skill, and description are accepted as user input and processed in scripts/main.cjs.
Boundary markers: Absent. Generated command files do not use delimiters or instructions to the agent to disregard instructions embedded within the description field.
Capability inventory: The skill utilizes fs.writeFileSync and fs.appendFileSync to modify command definitions, discovery catalogs, and internal routing tables.
Sanitization: Only the name parameter is sanitized via regex; the skill and description parameters are only trimmed, allowing potentially malicious instructions to persist in generated files.
[COMMAND_EXECUTION]: The skill performs file system modifications on internal agent directories (.claude/) to update discovery catalogs and intent routing logic, which determines how the framework interprets and executes user commands.

command-creator