The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute a local binary file located at .slipbox/bin/slipbox.
Evidence: The 'Ground each selected claim' section in SKILL.md contains a shell command: .slipbox/bin/slipbox evergreen add --slug <draft-slug> --reason "<tension description>".
Risk: The command incorporates dynamic arguments (<draft-slug> and <reason>) derived from the grounding process. If these inputs contain shell metacharacters and are not properly sanitized by the execution environment, it could lead to command injection.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingests and processes untrusted data from external sources.
Ingestion points: The 'Surface pass' and 'Ground each selected claim' sections in SKILL.md describe reading the 'whole source' and taking 'the resource the user names'.
Boundary markers: Absent. The instructions do not define clear delimiters or provide 'ignore embedded instructions' warnings when processing the source content.
Capability inventory: The skill can write files to paths defined in .slipbox/config.json and execute the .slipbox/bin/slipbox command.
Sanitization: Absent. There is no mention of sanitizing, escaping, or validating the content extracted from the external source before it is used to influence the agent's reasoning or the CLI command arguments.

ground-the-claim