The Agent Skills Directory

COMMAND_EXECUTION (HIGH): The script scripts/router.sh contains a shell command injection vulnerability. It interpolates the $QUERY variable into a jq filter string using single quotes. A query containing a single quote can terminate the string and allow an attacker to append and execute arbitrary shell commands on the host system.
Evidence: echo "$RESULTS" | jq -s ' { query: "'"$QUERY"'", ... } ' in scripts/router.sh.
PROMPT_INJECTION (LOW): The skill is vulnerable to indirect prompt injection and schema confusion because it ingests untrusted data from multiple sources without sanitization or boundary markers.
Ingestion points: scripts/index-skills.sh reads descriptions from external SKILL.md files; scripts/suggest-skills.sh processes user prompts; scripts/categorize-skills.sh reads directory names as skill names.
Boundary markers: Absent. The output generated by suggest-skills.sh is injected directly into the system prompt without delimiters or instructions to ignore embedded commands.
Capability inventory: The skill executes a local binary (ck), performs shell operations, and writes to local cache files.
Sanitization: Metadata and skill names are interpolated into JSON structures without proper escaping. Specifically, index-skills.sh only removes double quotes but leaves backslashes (which can escape the closing quote), and categorize-skills.sh performs no escaping on skill names, leading to potentially malformed or malicious JSON output.

skill-rag-router