The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's core functionality (prose run and the use statement in the DSL) allows fetching and executing .prose program files from remote URLs. By default, it resolves shorthand handles to https://p.prose.md/{path}, but also allows any http:// or https:// source. These programs are interpreted by the VM and can trigger any available agent tool, including filesystem and shell access.
[EXTERNAL_DOWNLOADS]: SKILL.md, prose.md, and compiler.md document mechanisms for fetching code and configurations from external sources like githubusercontent.com and the p.prose.md registry at runtime.
[CREDENTIALS_UNSAFE]: state/postgres.md explicitly warns that database credentials stored in the OPENPROSE_POSTGRES_URL environment variable are passed to subagent sessions and remain visible in logs. This exposure is part of the experimental PostgreSQL state management architecture.
[COMMAND_EXECUTION]: Several standard library files and examples (e.g., lib/vm-improver.prose, lib/profiler.prose, examples/45-plugin-release.prose) explicitly request and use bash: allow permissions to execute arbitrary shell commands for tasks like Git operations, tool detection, and Python script execution.
[INDIRECT_PROMPT_INJECTION]: The skill's architecture creates an indirect prompt injection surface. The VM (orchestrator) ingests and processes untrusted data from remote .prose files and user-provided conversation histories. The DSL uses **...** discretion markers that rely on LLM judgment to evaluate conditions, which could be influenced by malicious content embedded in the ingested data.
Ingestion points: Remote .prose files (SKILL.md), conversation histories (state/in-context.md), and sensitive local logs (examples/48-habit-miner.prose).
Boundary markers: The DSL uses session and context blocks, but there is no explicit instruction to the subagents to ignore potential instructions within the context variables.
Capability inventory: Subagents have access to sessions_spawn (Task), read, write, web_fetch, and exec (bash).
Sanitization: No evidence of automated sanitization or escaping of external content before interpolation into prompts was found in the VM specification.
[DATA_EXPOSURE]: examples/48-habit-miner.prose is designed to scan and read conversation history logs from a wide range of AI tools including Claude Code, OpenCode, Cursor, Aider, and GitHub Copilot, exposing highly sensitive user interaction data.

prose