The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using user-provided input, specifically python3 "$AARON_SKILLS_ROOT/scripts/registry-events.py" is-suppressed <subject-id>. The <subject-id> variable is derived from external input, creating a potential command injection vector if the agent does not perform strict sanitization of shell metacharacters.
[DYNAMIC_EXECUTION]: The skill uses dynamic path resolution to locate its internal scripts, instructing the agent to resolve AARON_SKILLS_ROOT using environment variables or git rev-parse --show-toplevel. This path is then used to execute a Python script (registry-events.py) at runtime.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted subscriber data which serves as an attack surface for indirect injection.
Ingestion points: The skill ingests subject-id and event-based data from the user's environment or system logs to perform lookups and record consent facts.
Boundary markers: The instructions specify that the system NFKC-normalizes strings and requires typed fields, providing some structural boundaries, but lacks explicit prompt delimiters for the processed data.
Capability inventory: The skill utilizes subprocess execution via python3 to read/write to the consent.ndjson stream.
Sanitization: While the skill documentation claims to normalize strings and enforce pseudonymity, it does not explicitly instruct the agent to escape the subject-id before interpolating it into the shell command template.

consent-registry