The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is designed to facilitate the execution of custom shell scripts at specific points in a research loop. The instructions guide the agent to copy example scripts, modify their contents, and use chmod +x to enable their execution.\n- [DYNAMIC_EXECUTION]: The skill relies on a pattern where the AI agent generates or adapts bash scripts which are then executed on the host system. This pattern of script generation and execution is central to the skill's functionality.\n- [INDIRECT_PROMPT_INJECTION]: The hook scripts ingest JSON data that includes fields influenced by the agent or external research results (e.g., asi.hypothesis, metric_name). This creates a surface for indirect injection if these fields contain malicious characters that are improperly handled by the scripts.\n
Ingestion points: Hook scripts read session state JSON from stdin during the before and after events (SKILL.md, examples/before/external-search.sh).\n
Boundary markers: No explicit boundary markers or sanitization warnings are present in the provided example scripts.\n
Capability inventory: The scripts utilize standard shell utilities, version control tools (git), and external CLI interfaces (search-cli, llm-cli, osascript). The output of these scripts is returned to the agent as a steer message, creating potential multi-step influence chains.\n
Sanitization: The example scripts use jq for parsing but do not consistently sanitize the resulting strings before interpolation into shell or sub-shell commands. Specifically, the macos-notify.sh example uses a quoting pattern in an osascript call that is susceptible to injection if the input strings contain double quotes or backticks.\n- [COMMAND_EXECUTION]: The example script examples/after/macos-notify.sh contains a flaw where user-influenced session metadata is passed to an osascript command without proper escaping, potentially allowing arbitrary code execution via AppleScript's shell execution capabilities.\n- [PRIVILEGE_ESCALATION]: The skill instructions direct the agent to use chmod +x to grant execution permissions to the newly created hook scripts in the .auto/hooks/ directory.\n- [EXTERNAL_DOWNLOADS]: The documentation and example scripts reference external tools and packages, such as the qmd package from the npm registry for local document indexing and generic tools like search-cli and llm-cli.

autoresearch-hooks