The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill uses the dynamic context execution pattern (!command) to run plannotator annotate-last $ARGUMENTS when the skill is loaded. The $ARGUMENTS variable is directly interpolated into the shell command without sanitization or quoting, which creates a command injection vulnerability. A user could provide input containing shell metacharacters (e.g., ;, |, &&) to execute arbitrary shell commands on the host system.\n- [COMMAND_EXECUTION]: The skill facilitates the execution of shell commands through its allowed tools and its dynamic context injection. The lack of input validation on the arguments passed to these commands presents a security risk.\n- [INDIRECT_PROMPT_INJECTION]: The skill's behavior is driven by the output of the shell command executed at load time. Without sanitization or boundary markers, a compromised tool output could influence the agent's subsequent actions.\n
Ingestion points: The output of the !plannotator command in SKILL.md.\n
Boundary markers: None are present to distinguish the command output from subsequent instructions.\n
Capability inventory: The skill uses Bash(plannotator:*) and instructions to revise messages in SKILL.md.\n
Sanitization: No sanitization is performed on the command output before it is processed by the agent.

plannotator-last