The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill instructions provide bash command templates where the agent is expected to manually interpolate variables like SEARCH_TERM, SESSION_ID_HERE, and /path/to/project. This pattern creates a shell command injection surface if the interpolated values contain shell metacharacters such as backticks, semicolons, or pipes.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest large amounts of untrusted historical data, which creates an attack surface for indirect prompt injection.
Ingestion points: Reads content from opencode.db (message and part tables), plans/*.md files, and prompt-history.jsonl (SKILL.md).
Boundary markers: Absent. The instructions do not provide delimiters or warnings to treat historical content as untrusted data.
Capability inventory: The skill uses bash to execute sqlite3, ls, cat, and tail (SKILL.md).
Sanitization: Absent. There are no instructions for sanitizing or escaping retrieved content before the agent processes it.
[COMMAND_EXECUTION]: The skill facilitates the execution of multiple shell commands to query databases, list files, and read logs. While it emphasizes read-only access for the database via SQLite URI parameters, the command execution capability remains broad.

opencode-memory