The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The SKILL.md file uses the ! syntax to execute a shell command at load time. This command attempts to locate and execute a skill-toc script from the local environment to build a table of contents.
[COMMAND_EXECUTION]: The scripts/launch-tuicr.sh script constructs and runs shell command strings through herdr or ghostty to facilitate TUI interaction. This pattern of wrapping terminal execution involves complex shell quoting and interpolation that represents a command execution risk.
[COMMAND_EXECUTION]: The scripts/resolve_session_test.py script utilizes subprocess.run to execute bash scripts during its contract tests, which can be risky if testing logic is exposed to untrusted inputs.
[DYNAMIC_EXECUTION]: The scripts/resolve-session.sh script executes Python code dynamically using python3 -c to filter and process JSON session data.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to read user annotations from the tuicr session and 'address' them directly. This ingestion of external data without proper sanitization creates a surface for indirect prompt injection attacks.
Ingestion points: Annotation content is read from tuicr review comments JSON output in Step 3 of the SKILL.md workflow.
Boundary markers: The instructions lack boundary markers or warnings to the agent to disregard instructions contained within the annotation text.
Capability inventory: The skill has access to powerful tools including Bash, Write, and Edit, and it executes several shell scripts.
Sanitization: There is no evidence of sanitization or safety filtering applied to the annotation content before it is processed by the agent.

tuicr