The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses emacsclient --eval to execute Lisp code in the user's Emacs environment. It constructs these commands by interpolating user-provided strings (such as the buffer name and search regex) directly into the Lisp form. A malicious user could provide a buffer name containing Lisp delimiters and additional commands (e.g., *scratch*\") (shell-command \"rm -rf /\") (list :buffer \") to achieve arbitrary code execution within the Emacs process.
[DATA_EXFILTRATION]: The skill is designed to read the contents of any Emacs buffer and return the text to the agent. This exposes sensitive information, including internal system logs (*Messages*), configuration files (like ~/.emacs), and any other private data the user may have open in their editor.
[PROMPT_INJECTION]: The instructions direct the agent to automatically treat any buffer-name reference in a user prompt as a request to read that buffer. This design makes it easier for an attacker to trigger the data exposure or Lisp injection vulnerabilities without the user explicitly calling a dangerous command.
[PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection (Category 8).
Ingestion points: The agent-skill-buffer function reads content from external Emacs buffers into the agent's context (SKILL.md).
Boundary markers: None are present; the text is returned raw to the agent.
Capability inventory: The skill uses the Bash tool to run emacsclient, which can execute arbitrary shell commands via Emacs' shell-command function.
Sanitization: No sanitization or filtering is performed on the buffer content before it is processed by the agent.

buffer