The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data from multiple sources that ingest untrusted external information, such as social media feeds (tweet-roundup) and security scan results (vuln-scanner). If an attacker successfully influences these source skills, they could potentially inject instructions that are aggregated here.
Ingestion points: output/.chains/*.md and memory/logs/*.md are read to extract entities and themes.
Boundary markers: No explicit delimiters or instructions are provided to the agent to treat the aggregated data as untrusted content.
Capability inventory: The skill writes aggregated content to memory/topics/convergence-signals.md and .pending-notify-temp/, and executes the ./notify script with the resulting data.
Sanitization: There is no evidence of sanitization or escaping of the extracted entities/themes before they are written to files or passed to the notification tool.
[COMMAND_EXECUTION]: The skill executes a local script ./notify to send convergence alerts. While this appears to be a standard part of the agent's environment, it involves passing file content generated from aggregated external data to a shell command.

narrative-convergence