The Agent Skills Directory

[COMMAND_EXECUTION]: The post_execution hook contains a shell command injection vulnerability where the $TASK variable is interpolated directly into a shell command (npx agentic-flow@alpha memory store-pattern --task "Integration: $TASK" ...). This allows arbitrary command execution if the task description contains shell metacharacters such as semicolons, pipes, or backticks. Additionally, the hooks use malformed redirection syntax (2>$dev$null) and suspicious path variable interpolation (services$agentic-flow-hooks/) which may lead to unexpected file operations.\n- [REMOTE_CODE_EXECUTION]: The skill automatically downloads and executes code from the agentic-flow@alpha package on the public NPM registry using npx during both pre_execution and post_execution phases. Running unpinned alpha-version code from a public registry introduces significant supply chain risks.\n- [EXTERNAL_DOWNLOADS]: The skill uses npx to fetch external dependencies from the NPM registry at runtime, which is executed as part of the agent's lifecycle hooks.\n- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting external data (the user-defined task) and utilizing it in a sensitive execution context (shell environment) without sanitization.\n
Ingestion points: The $TASK variable in the post_execution hook.\n
Boundary markers: None (the variable is directly embedded in a double-quoted shell string).\n
Capability inventory: Full shell access via hook execution, including network capabilities and package installation via npx.\n
Sanitization: None detected.

agent-v3-integration-architect