The Agent Skills Directory

[COMMAND_EXECUTION] (HIGH): The skill instructions explicitly direct the agent to run python3 scripts/evaluate.py "Your prompt here" and python3 scripts/optimize.py "Your prompt here". This pattern is highly susceptible to command injection if the agent fails to escape shell metacharacters (e.g., ;, &, |, `) in the user-provided prompt string.
[REMOTE_CODE_EXECUTION] (HIGH): By allowing arbitrary command execution through shell injection, an attacker can execute arbitrary scripts, download malicious payloads, or compromise the agent's environment.
[DATA_EXFILTRATION] (MEDIUM): While no explicit exfiltration code is present in the markdown, the command execution vulnerability enables an attacker to access environment variables, local files (like ~/.ssh or .env), and transmit them to external servers using common system utilities like curl or wget.
[INDIRECT_PROMPT_INJECTION] (HIGH): The skill's core function is processing untrusted external data (user prompts).
Ingestion points: The "Your prompt here" placeholder in SKILL.md identifies where untrusted data enters the agent context.
Boundary markers: The instructions provide no delimiters or sanitization guidelines for the agent to follow when passing this data to the shell.
Capability inventory: The skill utilizes python3 subprocess calls via scripts/evaluate.py and scripts/optimize.py as documented in SKILL.md.
Sanitization: There is no evidence of input validation or escaping mechanisms to prevent adversarial content from influencing the command line execution.

prompt-optimizer