Skill instructions interpolate unsanitized user input into Python/shell source (query.md, add-watch.md)

[Simwawa]

Summary

Two of the graphify skill's reference docs instruct the host agent to interpolate raw, unsanitized user-controlled values directly into generated Python or shell source, which is unsafe.

.copilot/skills/graphify/references/add-watch.md (around line 17)

URL, AUTHOR, and CONTRIBUTOR are user-provided values that the instructions interpolate into single-quoted Python source. An embedded apostrophe causes a syntax error, and crafted input can execute arbitrary Python.

Fix suggestion: pass these values as command-line arguments or structured input (e.g. JSON via stdin) instead of embedding them textually into generated source.

.copilot/skills/graphify/references/query.md (around line 171)

The save-result template instructs the agent to substitute the user's verbatim question and the generated answer directly into a shell command. Double quotes still allow command substitution/backticks, and embedded quotes break argument boundaries — so ordinary content can fail and crafted content can execute commands.

Fix suggestion: pass these values through an argv-safe mechanism (e.g. write structured input to a temp file and invoke via Python subprocess.run([...]) with an argument list, not a shell string). Apply the same fix to the other save-result templates in that file.

[Ashfaqbs]

Verified this against the actual current source, and the concern is real — but the file paths in the report don't exist (.copilot/skills/graphify/references/... 404s), and the actual scope is bigger than the two spots described.

Where this actually lives: the per-agent skill files under graphify/skills/<agent>/references/ (14 variants: pi, amp, trae, claw, kilo, kiro, droid, codex, vscode, claude, agents, copilot, windows, opencode) are generated by tools/skillgen/gen.py from shared fragments under tools/skillgen/fragments/references/. add-watch.md's vulnerable block lives in tools/skillgen/fragments/references/shared/add-watch.md — confirmed the exact pattern described: ingest('URL', ..., author='AUTHOR', contributor='CONTRIBUTOR') inside a single-quoted Python literal, with the instruction to textually substitute raw URL/AUTHOR/CONTRIBUTOR values before execution.

The bigger finding — the same pattern recurs three more times in tools/skillgen/fragments/references/query/default.md, all save-result invocations built the same way (shell command string, values substituted textually into --question "..."/--answer "..." inside double quotes, which doesn't stop backticks/$()/embedded-quote breakout):

$(cat graphify-out/.graphify_python) -m graphify save-result --question "ORIGINAL_QUESTION" --answer "ANSWER" --type query --nodes NODE1 NODE2

— once for the /graphify query flow, once for path, once for explain. The --answer value here is especially concerning versus add-watch.md's AUTHOR/CONTRIBUTOR: it's LLM-generated free text answering a user's question, arbitrary length, no realistic bound on what characters it contains, substituted straight into a shell string on what's likely the single most-run code path in the tool (every query saves a result). A crafted question or a page's content reflected back through the answer is enough to reach this.

Since fixing this properly means editing the shared fragments and regenerating 14 downstream files (plus tools/skillgen/expected/* fixtures), rather than patching individual generated copies, I'd want to confirm the fix shape before sending a PR that touches that much generated surface:

• For add-watch.md: pass URL/AUTHOR/CONTRIBUTOR via sys.argv (python -c "..." "$URL" "$AUTHOR" "$CONTRIBUTOR", i.e. real shell argv passing, which is escape-safe) instead of textual substitution into the source, or write them to a temp JSON file first and have the inline script read it.
• For save-result's three call sites in query/default.md: same shape — argv-safe invocation, or (given --answer can be long) a temp-file handoff (save-result --from-file <path> reading a JSON payload) rather than a growing command-line string either way.

Happy to implement whichever direction you'd prefer, regenerate the 14 skill variants + expected fixtures via gen.py, and add a test asserting a quote/backtick/$()-bearing value round-trips safely through both flows.