The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the agent to execute a variety of shell commands including sqlite3, jq, git, awk, and the agy (Antigravity) CLI tool to perform data mining and process results.
[DATA_EXFILTRATION]: The skill accesses highly sensitive private data, including local conversation databases (conversation_summaries.db) and raw transcript logs (transcript.jsonl). While intended for local mining, this involves reading the entirety of a user's interaction history.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from past interactions and source control logs.
Ingestion points: Historical conversation transcripts and git log outputs are read from the file system (SKILL.md).
Boundary markers: The skill uses basic prompt instructions to direct the agy worker, but fails to use robust delimiters to isolate the untrusted data from the system instructions.
Capability inventory: The skill has access to the local file system, git history, and the ability to execute shell commands and spawn sub-workers.
Sanitization: There is no evidence of sanitization or filtering of the content retrieved from transcripts before it is passed to the next stage of the workflow.
[DYNAMIC_EXECUTION]: The 'Map' step constructs a shell command where the ${FLOW} variable (containing raw transcript content) is interpolated directly into a double-quoted string. Because this content originates from past user inputs and LLM responses, it could contain shell-special characters (like backticks or subshell syntax) that may lead to arbitrary command execution on the host machine.

show-me-the-money