The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes several local Python scripts (e.g., brain_cli.py, dashboard_tui.py, morning_briefing.py) located in the user's home directory. These shell commands are constructed by interpolating variables that can originate from user input or local files, such as project slugs or article names.
[DYNAMIC_EXECUTION]: The skill performs runtime execution of Python code snippets for database access. It also dynamically modifies the Python module search path (sys.path) to load and execute code from ~/.coco/knowledge at runtime, which constitutes dynamic loading from a computed path.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect injections from local project data.
Ingestion points: It reads and processes project_brain.db found in the current working directory and the contents of CLAUDE.local.md.
Boundary markers: The ingested data is incorporated into the agent's dashboard context without any visible boundary markers or instructions to disregard embedded commands.
Capability inventory: The skill can execute local scripts, modify local documentation files, and perform SQLite database operations.
Sanitization: No evidence of sanitization or validation was found for the content extracted from local project files before it is processed by the agent.
[DATA_EXFILTRATION]: The skill accesses multiple local data sources including project_brain.db and knowledge databases in the user's home directory. While no direct exfiltration to external third-party domains was identified, these sensitive data sources are read and processed within the agent's active context, creating a potential path for data exposure.

coco