The Agent Skills Directory

[DYNAMIC_EXECUTION]: The hook script hooks/sessions-gate.sh dynamically sources a configuration file using the command . "$CONF" (where $CONF defaults to ~/.config/ai-limits/config). While intended for user customization, this pattern allows for arbitrary shell code execution if the configuration file is modified by a malicious process or actor, as the hook executes every time a prompt is submitted.
[INDIRECT_PROMPT_INJECTION]: The skill instructions in SKILL.md require the agent to read and summarize data from external state files to generate reports.
Ingestion points: The agent reads session logs (sessions-YYYY-MM-DD) and change logs (changes.log) from ~/.config/ai-limits/state/.
Boundary markers: The instructions do not specify any delimiters or warnings to ignore potentially malicious content within these logs.
Capability inventory: The agent has the capability to read local files and display their contents (or summaries thereof) to the user.
Sanitization: There is no explicit requirement for the agent to sanitize or validate the content of these files before reporting, which could allow an attacker to influence the agent's output by injecting instructions into the session IDs or log entries.

limits-sessions