The Agent Skills Directory

[DYNAMIC_EXECUTION]: The helper script agent-skill-ent.el uses the Emacs Lisp load function to execute the contents of .ent.el files found in the project directory. If an agent is working in a malicious repository, this allows the execution of arbitrary Lisp code within the user's running Emacs server.\n- [COMMAND_EXECUTION]: The skill uses the Bash tool to invoke emacsclient --eval, which executes shell commands and Lisp functions on the host system. While this is the intended functionality for running build tasks, it is leveraged to execute untrusted project code.\n- [DATA_EXFILTRATION]: The agent-skill-ent-run and agent-skill-ent-log functions return the entire contents of the *ent-log* buffer to the agent. This may contain sensitive information such as environment variables, authentication tokens, or private project data printed during the build process.\n- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to process the untrusted output from build tasks verbatim. An attacker could place malicious instructions in the build output (e.g., via a crafted .ent.el or task failure message) to influence the agent's subsequent actions.\n
Ingestion points: Full contents of the *ent-log* buffer (referenced in SKILL.md and agent-skill-ent.el).\n
Boundary markers: None. The instructions explicitly direct the agent to "Work with it directly" and "Present :text to the user verbatim".\n
Capability inventory: Access to the Bash tool and file system manipulation.\n
Sanitization: No filtering or sanitization is performed on the log content before it is passed to the agent.