The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions explicitly direct the agent to use the shell_exec tool to create project folders (e.g., mkdir -p). While the examples show benign directory creation, the reliance on a general-purpose shell execution tool for folder management increases the risk of arbitrary command execution if the path arguments are influenced by malicious input.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8). It ingests untrusted data from users—such as event titles, descriptions, and locations—and saves them into project files. This data is later retrieved and presented back to the agent via the list_events action. Maliciously crafted event details could contain instructions designed to hijack the agent's logic when the calendar is viewed or queried.
Ingestion points: User-provided parameters title, description, and location in the manage_calendar tool (SKILL.md).
Boundary markers: None identified. The instructions do not specify the use of delimiters or warnings to ignore instructions within the stored event data.
Capability inventory: The skill uses shell_exec for directory creation and tool-mediated file writes for event storage.
Sanitization: No evidence of sanitization or validation for the content of event fields.

magic-calendar