claude-simone

The version-manager.js script uses execSync to execute git commands with user-provided input that is not properly sanitized. The 'tag' and 'migrate-tags' commands construct shell commands using string interpolation with user-controlled values like component.version and tag names, creating command injection vulnerabilities.

The install-mcp.js script constructs curl commands using string interpolation with template names that could potentially be controlled or influenced by external factors. While the template names appear to be hardcoded in this instance, the pattern of using execAsync with string interpolation for shell commands creates a potential injection surface.

The skill contains instructions that execute system-level git commands and curl operations that operate beyond the project scope. The install-mcp.js file executes 'git --version' checks and downloads files from external URLs using curl. The version-manager.js creates git tags and accesses git repository state, which are system-level operations that modify version control state beyond just file operations.

The version-manager.js script contains conditional logic that references git tags and file system state that users wouldn't necessarily be aware of. The script checks for existing git tags, reads package.json files, and makes decisions based on file existence - all system state that could vary unexpectedly.

The skill executes git commands and npm operations through execSync without declaring these as dependencies. The version-manager.js file uses execSync to run 'git tag', 'git rev-list', and other git commands, while install-mcp.js uses execAsync to run 'curl' and 'git --version'. These represent undeclared system dependencies that could be exploited if the underlying commands are compromised or if the skill is run in an environment where these tools behave unexpectedly.

The install-mcp.js file downloads template files directly from GitHub raw URLs using curl without integrity verification. This bypasses package registry security checks and could be exploited if the GitHub repository is compromised or if there's a man-in-the-middle attack. The downloaded content is written directly to the filesystem without validation.