The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill instructs the agent to use emacsclient --eval to execute Lisp code constructed from user-supplied arguments (buffer names and regex patterns). There is a risk of Lisp injection if the agent does not properly escape these inputs, potentially allowing a malicious prompt to execute arbitrary code within the user's running Emacs process.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from Emacs buffers into the agent's context.
Ingestion points: Buffer content is read via emacsclient and agent-skill-buffer.el (referenced in SKILL.md).
Boundary markers: None. The skill does not instruct the agent to use delimiters or warnings when processing buffer content.
Capability inventory: The agent has access to the Bash tool and the ability to interact with the local Emacs environment, which can perform filesystem operations and network requests.
Sanitization: None. Data is brought directly into the conversation text.
[DATA_EXFILTRATION]: The skill can be used to access sensitive information stored in Emacs buffers. Buffers such as *Messages* often contain diagnostic logs, environment variables, or even credentials accidentally printed to the console. An attacker could use indirect prompt injection to trick the agent into reading these sensitive buffers and sending the contents to an external party.
[COMMAND_EXECUTION]: The skill relies on the Bash tool to run emacsclient. While the intended use is specific to buffer reading, the underlying mechanism provides a bridge between the agent and the host system's shell and Emacs process, which could be abused if the agent is manipulated by malicious input.

read-emacs-buffer