The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/analyze-logging.sh is vulnerable to shell command injection through its first argument (PROJECT_DIR).
The script uses an unquoted heredoc (cat << EOF) to generate JSON output. In this mode, the shell evaluates command substitutions (e.g., $(...)) contained within variable values at runtime.
Malicious input passed to the script could lead to arbitrary code execution within the context of the agent or the system running the script.
[COMMAND_EXECUTION]: The script scripts/analyze-logging.sh allows for arbitrary file write operations.
The script accepts a user-defined output path (OUTPUT_FILE) and redirects the generated JSON content to that path without validation.
This capability could be abused to overwrite sensitive system files or configuration files if the calling process has sufficient permissions.
[DATA_EXFILTRATION]: The script performs automated searches across project manifest files (such as package.json, requirements.txt, and go.mod) to detect logging libraries.
This represents a broad file-read capability that could be leveraged to access and expose sensitive configuration data if the input path is manipulated by an attacker.

logging-fundamentals