The Agent Skills Directory

[COMMAND_EXECUTION]: The skill constructs shell commands by directly interpolating shell variables into a command string for the kimi tool. Specifically, in the 'Delegate via Bash' section, the variables $CONTEXT (derived from mnemos resume) and $CONSTRAINTS (derived from icpg query) are placed inside a double-quoted string passed to the -p argument. If the content of the files, symbol metadata, or task memory contains shell metacharacters like backticks, semicolons, or command substitutions, it will result in arbitrary code execution on the user's system.
[DATA_EXFILTRATION]: The skill's 'Kimi Delegation' logic explicitly uses grep to scan the codebase for sensitive keywords such as org_id, user_id, auth, and pii. This harvested data, along with surrounding file context, is then packaged into a prompt and transmitted to external AI tools (kimi, codex) via shell-based delegation. This represents a systematic collection and exfiltration of credentials and private information to third-party services.
[PROMPT_INJECTION]: The skill is highly vulnerable to indirect prompt injection due to its automated processing of untrusted data.
Ingestion points: Data is ingested from git diff outputs, icpg query results (which include function bodies and function graphs), and mnemos task memory.
Boundary markers: The skill uses basic Markdown headers (e.g., ## Context, ## Constraints) to separate data, which can be easily bypassed by adversarial content within source code or comments.
Capability inventory: The system can execute external CLI tools (kimi, codex, icpg), perform git operations, and write to local disk via mnemos checkpoints.
Sanitization: There is no evidence of sanitization, escaping, or filtering of the external content before it is interpolated into the prompts for the delegated agents.

cross-agent-delegation