The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the agent to construct shell commands by directly interpolating user-provided arguments into calls to the arra-oracle-skills CLI (e.g., arra-oracle-skills install -g --profile <name> -y). This creates a significant command injection surface where a malicious user could provide input containing shell metacharacters (such as ;, &&, or |) to execute arbitrary code on the underlying host system.
[COMMAND_EXECUTION]: The use of the -y flag across all installation and uninstallation commands (arra-oracle-skills install -g -y) explicitly instructs the system to bypass confirmation prompts. This increases the risk and impact of successful command injection by removing the opportunity for human-in-the-loop review of the final command being executed.

go