The Agent Skills Directory

[COMMAND_EXECUTION]: The documentation in references/manifest-render.md provides examples where user-defined parameters (.U.target) are directly interpolated into backend_launch_command strings within the lzc-manifest.yml. This pattern is vulnerable to shell command injection if the user input contains shell metacharacters (e.g., ;, &&, |), as there are no instructions provided for sanitization or escaping.
[REMOTE_CODE_EXECUTION]: The application.injects feature described in SKILL.md and references/injects.md allows for the injection of JavaScript into application frontend pages. The specification explicitly supports http(s):// as a source for these scripts, enabling the execution of arbitrary remote code in the user's browser context.
[EXTERNAL_DOWNLOADS]: The system is configured to fetch and execute scripts from external URLs via the scripts[].src field, which can point to untrusted remote domains.
[PROMPT_INJECTION]: The skill processes untrusted user data from lzc-deploy-params.yml and interpolates it into critical configuration files (lzc-manifest.yml).
Ingestion points: User-provided values are ingested via the lzc-deploy-params.yml file and accessed through the .U template variable.
Boundary markers: None identified. The Go template syntax ({{ ... }}) is used directly without delimiters or instructions to ignore embedded malicious content.
Capability inventory: The rendered manifest can execute shell commands (backend_launch_command) and inject JS scripts.
Sanitization: There is no mention of input validation, escaping, or sanitization of user parameters before they are rendered into the final configuration.

lazycat-dynamic-deploy