The Agent Skills Directory

[COMMAND_EXECUTION]: The search workflow described in Step 2 templates shell commands by interpolating keywords directly into grep calls (e.g., grep -rni ... '<keyword>' ...). If the agent extracts keywords containing shell metacharacters or single quotes from a user's question, it could lead to arbitrary command execution via the Bash tool.- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests untrusted data from the codebase and submodules to provide answers and suggest executable commands.
Ingestion points: The skill reads documentation from .internal-docs/ and source code from packages/, scripts/, .config/, and .github/.
Boundary markers: There are no explicit delimiters or instructions to the agent to treat content within these files as untrusted or to ignore embedded instructions.
Capability inventory: The skill has access to the Bash tool and is explicitly instructed to offer execution of commands found within the processed files.
Sanitization: The workflow does not include steps to sanitize, escape, or validate the content extracted from files before presenting it to the user for execution.

ask-internal