The Agent Skills Directory

[COMMAND_EXECUTION]: Potential shell command injection in SKILL.md. The skill executes a Python script by directly interpolating user-provided arguments into a bash command string: python3 .../manage_watchlist.py $ARGUMENTS. This pattern is highly susceptible to injection if the agent's execution environment does not properly sanitize or escape the $ARGUMENTS variable.
[DATA_EXFILTRATION]: Path traversal vulnerability in scripts/manage_watchlist.py. The name argument is used to construct file paths using os.path.join(WATCHLIST_DIR, f"{name}.json") without any sanitization. An attacker could use ../ sequences to read existing JSON files or overwrite files in other directories with JSON-formatted data.
[DATA_EXFILTRATION]: Exposure of local environment metadata. The SKILL.md file contains a hardcoded absolute path (/Users/kikuchihiroyuki/...) that reveals the specific system username of the author or environment owner.
[PROMPT_INJECTION]: The skill processes untrusted user input which is then persisted to the filesystem, creating an attack surface for indirect prompt injection.
Ingestion points: User-provided name and symbols arguments passed via sys.argv to manage_watchlist.py.
Boundary markers: None. Input is processed and stored directly.
Capability inventory: The script has the capability to read and write files and is executed via a shell tool.
Sanitization: There is no validation or sanitization of input strings before they are used in path construction or file writes.

watchlist