The Agent Skills Directory

Dynamic Execution (MEDIUM): The skill's primary mechanism relies on executing dynamically generated shell commands. Specifically, SKILL.md instructs the agent to use an ACTIVATION_COMMAND provided by detect.sh (a file referenced but not included in the provided set). Common examples include eval "$(rbenv init -)" and source .../chruby.sh. These patterns execute shell code generated or loaded at runtime, which is a high-risk pattern if the source output is compromised.
Indirect Prompt Injection (LOW): The skill proactively reads untrusted files from the project directory (e.g., Gemfile, .ruby-version, .tool-versions, .mise.toml). A malicious repository could craft these files to influence the agent's behavior or inject malicious strings into the variables parsed by the agent.
Ingestion points: .ruby-version, .tool-versions, .mise.toml, and Gemfile are read by detect.sh to determine versions.
Boundary markers: Absent; there are no instructions to ignore embedded commands within these project files.
Capability inventory: The agent is authorized to execute shell commands (bash), write configuration files (~/.config/ruby-skills/preference.json), and perform environment activation.
Sanitization: The provided scripts (e.g., set-preference.sh) include basic whitelisting for manager names, but the logic for parsing project files in the missing detect.sh cannot be verified.
Command Execution (LOW): detect-all-managers.sh uses timeout 1 bash -lc to verify the presence of managers like rbenv, rvm, and asdf. Running commands within a login shell (-l) is an environment-sensitive operation that can be influenced by malicious shell profiles (e.g., .bash_profile).

ruby-version-manager