The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a Node.js script using the Bash tool and passes the $ARGUMENTS variable directly into the shell command without quoting or sanitization. If the agent fails to validate the input, this provides a surface for shell command injection using metacharacters such as ;, &&, or |.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to recover context by replaying summaries of previous sessions. This creates an indirect prompt injection surface where instructions hidden in previous session history (such as file contents, previous tool outputs, or user messages) could be re-injected into the current session to influence the agent.
Ingestion points: Session summaries retrieved and displayed via src/replay.js.
Boundary markers: The skill does not define specific delimiters or instructions to ignore potential commands embedded within the session summaries.
Capability inventory: The skill utilizes the Bash tool to execute local scripts and display output.
Sanitization: There is no evidence of sanitization, filtering, or escaping applied to the historical session data before it is re-introduced to the agent's context.

cco-replay