The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructions (Step 10) direct the agent to run uvx solograph --help. The uvx tool is a runner that dynamically fetches and executes packages from the PyPI registry. Since solograph is not a recognized trusted vendor or well-known utility, this allows for the execution of unverified remote code within the user's environment.
[INDIRECT_PROMPT_INJECTION]: The skill collects extensive free-text data from users via AskUserQuestion and writes these responses directly into Markdown and YAML configuration files such as manifest.md and defaults.yaml. As these files are designed to be read and interpreted by other skills (like /scaffold and /validate), they create a vector for indirect prompt injection where malicious text provided during onboarding could manipulate the agent's behavior in future sessions.
Ingestion points: User responses gathered in Steps 3, 5, 6, and 7 of SKILL.md.
Boundary markers: The skill does not use delimiters or instructions to treat the interpolated content as data rather than instructions in the generated files.
Capability inventory: The ecosystem includes tools for Bash, Write, Edit, and Read, providing a significant impact surface for successful injection.
Sanitization: No validation or escaping logic is applied to the user input before it is written to the filesystem.
[COMMAND_EXECUTION]: The skill uses the Bash tool to perform environment setup, specifically executing mkdir -p ~/.solo-factory. While this specific instance is functional and localized to the user's home directory, it confirms the skill's reliance on direct shell command execution.

solo-init