The Agent Skills Directory

[COMMAND_EXECUTION]: The skill constructs shell commands by directly interpolating the $ARGUMENTS variable, which contains user-supplied input. If the underlying platform does not provide automatic shell escaping, an attacker could use shell metacharacters (e.g., ;, &, |) to execute arbitrary commands.
Evidence:
rg -i "$ARGUMENTS" ~/.claude/LIFEOS/MEMORY/KNOWLEDGE/ --type md -l in the search section.
curl -sL with $ARGUMENTS in the ingest section.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection by fetching and processing untrusted content from external URLs or local files during the ingest workflow.
Ingestion points: The ingest <url-or-file> subcommand fetches external data via WebFetch or curl (SKILL.md).
Boundary markers: There are no defined delimiters or instructions for the agent to ignore potentially malicious instructions embedded in the fetched content.
Capability inventory: The agent has capabilities to execute shell commands (rg, curl), run local scripts via bun, and write files to the local file system.
Sanitization: The instructions lack specific requirements for sanitizing or escaping content retrieved from external sources before the agent summarizes or stores it.
[EXTERNAL_DOWNLOADS]: The ingest command allows fetching content from arbitrary, user-supplied URLs using curl -sL in a shell environment.
Evidence: curl -sL logic described in the ingest workflow of SKILL.md.

Knowledge