The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/falsify.py executes shell commands extracted from the YAML frontmatter of SKILL.md files using subprocess.run(shell=True). Although it applies a safety filter (_is_safe_declared) that denies certain keywords (such as sudo, curl, and rm), the execution of externally-defined strings in a shell environment remains a significant security risk due to potential filter bypass techniques.
[INDIRECT_PROMPT_INJECTION]: The skill is inherently susceptible to indirect prompt injection as it autonomously ingests and 'learns' from untrusted conversation history to update behavioral rules and persistent memories.
Ingestion points: Conversation messages are read from opencode.db and search.db by scripts/outcomes.py, scripts/proposer.py, and scripts/shift.py.
Boundary markers: Learned lessons and rules are stored in memories.jsonl and rules.yaml and later rendered into the agent's context (e.g., in memory.context.md) without explicit security delimiters or instructions to ignore embedded malicious content.
Capability inventory: The skill has the ability to execute shell commands (via falsify.py) and perform network requests (via autolearn.py).
Sanitization: There is no sanitization or validation of the 'learned' content beyond basic slugification for identification; the system treats user corrections and preferences as authoritative instructions.
[DATA_EXFILTRATION]: The synchronization feature in scripts/autolearn.py uses the requests library to push the contents of the local knowledge store (including memories.jsonl and user-profile.md) to a remote server. While the implementation in scripts/sync_crypto.py uses end-to-end encryption (AES-256-GCM), the capability to send sensitive user profile data to an external URL constitutes a managed data exfiltration vector.
[DYNAMIC_EXECUTION]: Several scripts utilize dynamic execution or loading patterns. scripts/falsify.py and scripts/test_sync_e2e.py use subprocess functions to run tests and local services. scripts/shift.py and scripts/test_repair_skill_use_counts.py employ __import__ for dynamic module loading. Additionally, scripts/shift.py uses re.compile() for processing candidate utterances.

autolearn