The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands (e.g., grep, sort) using a <resource-slug> variable in Step 2. If this identifier is derived from untrusted input or manipulated by a user, it could lead to command injection or unauthorized reading of files on the system.
[COMMAND_EXECUTION]: In Step 7, the skill directs the agent to derive filenames directly from user-provided "claim text." The absence of sanitization requirements or path validation creates a risk of path traversal, potentially allowing an attacker to overwrite sensitive files or create files outside the designated vault directory.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through its ingestion of CSV data.
Ingestion points: Data is read from .agents/slipbox/candidates/*.csv files to drive the selection and discussion process (Step 2).
Boundary markers: There are no explicit delimiters or instructions to ignore malicious content embedded within the CSV fields (such as the reason field populated by other skills).
Capability inventory: The agent has the capability to execute shell commands (grep, sort) and perform file system writes (Step 7 and 8).
Sanitization: No sanitization or escaping of external data is specified before it is used to influence agent behavior or file operations.

discuss-idea