The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes shell command templates for document rendering using pandoc. These templates interpolate variables such as <file> and <title> (found in references/schema.md) which are derived from user-provided questions or content titles. If these values are not properly sanitized of shell metacharacters (e.g., ;, |, `), it could lead to arbitrary command execution.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection. It is designed to capture content from arbitrary external URLs and store it as 'raw' notes, which are later processed into a structured 'wiki' and used to answer queries.
Ingestion points: SKILL.md defines a capture mode that fetches content from URLs, PDFs, and web articles into the local vault.
Boundary markers: There are no instructions provided to the agent to use delimiters or to ignore embedded instructions within the captured content during the compile or query phases.
Capability inventory: The skill possesses file read/write capabilities, shell execution via pandoc and git, and network access for content fetching.
Sanitization: No explicit sanitization or content validation steps are defined before processing ingested data or using it in query responses.
[EXTERNAL_DOWNLOADS]: The skill incorporates synchronization with remote Git repositories using git pull --rebase --autostash and references external services and tools such as executor.sh and pandoc for its core functionality. While these are common developer tools, they represent vectors for interacting with external, potentially untrusted sources.

second-brain