The Agent Skills Directory

[COMMAND_EXECUTION]: Command injection vulnerability in the scripts/run-taze.sh script.
The script accepts user-provided package names via the --include argument, which are stored in the $include variable.
The variable is used to construct $include_flag and then expanded without quotes in the final execution line: taze major $recursive $include_flag --include-locked.
The script explicitly disables shell linting (# shellcheck disable=SC2086) for this line to allow word splitting, which enables an attacker to inject arbitrary shell commands using metacharacters (e.g., ;, &, |, or backticks) within the package name arguments.
[EXTERNAL_DOWNLOADS]: Reliance on unverified external CLI tools.
The skill requires the installation and execution of taze and ni CLI tools.
SKILL.md provides instructions for the global installation of these tools from the NPM registry (npm install -g taze).
These dependencies are downloaded and executed at runtime, introducing a supply chain risk if the packages are compromised or if typosquatting occurs.

bump-deps