The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a shell piping pattern to commit state changes: echo '<transaction-json>' | <plugin-root>/scripts/state-commit. The content of <transaction-json> is dynamically constructed using inputs such as --branch and --commit. If these inputs are not properly sanitized, they could be used to inject malicious shell commands through metacharacters or subshell expansion.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it processes data from external state files to make logic decisions.
Ingestion points: The skill reads .agent-atelier/loop-state.json and .agent-atelier/work-items.json to validate status transitions and queue positions.
Boundary markers: No explicit delimiters or boundary markers are defined to isolate untrusted data from the agent's instructions.
Capability inventory: The skill has access to Bash for command execution and Read for file system access.
Sanitization: There is no evidence of sanitization or strict schema validation for the data ingested from the state files before it is processed or used in shell command construction.

candidate