The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute a shell command for TRIZ analysis using string interpolation of user-provided topics. The command PYTHONPATH="${CLAUDE_PLUGIN_ROOT}/src" python3 -m tome.channels.triz analyze --topic "<topic>" --domain <domain> in SKILL.md is vulnerable to command injection if the topic or domain parameters contain shell metacharacters such as backticks, semicolons, or subshell expansions.
[INDIRECT_PROMPT_INJECTION]: The skill aggregates content from untrusted external sources including Reddit, Hacker News, and GitHub. This data is merged and synthesized into reports, creating an attack surface where malicious external content could influence agent behavior.
Ingestion points: External data is ingested via agents such as tome:discourse-scanner, tome:code-searcher, and tome:web-searcher as defined in SKILL.md.
Boundary markers: The instructions lack explicit boundary markers (e.g., XML tags or delimiters) to separate untrusted external content from system instructions during synthesis.
Capability inventory: The skill has the ability to write to the file system (docs/research/) and execute subprocess commands (python3 -m tome.channels.triz) across its main workflow.
Sanitization: There is no evidence of sanitization or validation of external findings before they are passed to the synthesis and ranking modules.

research