The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from state.md and a 'Hand-off' block generated by previous, potentially untrusted agent turns. The next-candidate value is extracted and used to control subsequent system-level actions.
Ingestion points: state.md (via STELOW_STATE marker) and the previous skill's ## Hand-off block.
Boundary markers: None present to distinguish instructions from data within the hand-off blocks.
Capability inventory: Executes scripts/stelow advance, awk, grep, and jq via shell.
Sanitization: The skill performs a validation check against transitions.md but lacks proper shell-escaping for variables used in command execution.
[COMMAND_EXECUTION]: The skill frequently executes shell commands and local scripts to perform state transitions.
Evidence: Calls scripts/stelow status, scripts/stelow advance, jq, awk, and grep within the bash algorithm.
Context: scripts/stelow is a vendor-provided tool (calionauta) used for workflow orchestration.
[DYNAMIC_EXECUTION]: The algorithm dynamically constructs shell commands using variables $next and $current which are populated from file contents.
Evidence: scripts/stelow advance "$next" and cat >> "$STELOW_STATE" use shell interpolation that could be exploited if the input data contains shell metacharacters that bypass the grep validation.

stelow-router