The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute a CLI command using a shell heredoc pattern: qmd query "$(cat <<EOF ... EOF )". The fields within this heredoc (intent, lex, vec, hyde) are generated based on the user's query. This pattern is susceptible to command injection if the user's input contains shell metacharacters or command substitution sequences that are not properly escaped by the agent before the shell execution.
[DATA_EXFILTRATION]: The skill uses grep, Glob, and the qmd tool to access the local filesystem. A malicious user could potentially craft a query that causes the agent to search for and read sensitive files located outside of the designated wiki/ directory.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it reads and synthesizes information from external wiki pages that may contain malicious instructions.
Ingestion points: Local filesystem via wiki/index.md, search results from qmd, and files identified by grep in SKILL.md.
Boundary markers: Absent; there are no delimiters or instructions to the agent to disregard instructions found within the retrieved wiki content.
Capability inventory: Includes shell command execution (qmd, grep), MCP tool usage (mcp__qmd__query), and the ability to write new pages or sections to the filesystem in wiki/sources/.
Sanitization: No evidence of sanitization or validation of the wiki content before it is processed by the agent.

wiki-query