The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill instructions direct the agent to construct shell commands by interpolating user-controlled input ($ARGUMENTS) directly into a template: uv run ... --query "<question>". This lacks proper sanitization or escaping, which could allow a malicious user to perform command injection by providing input that terminates the intended query string and executes arbitrary code.
[DYNAMIC_EXECUTION]: The skill captures a wait_command string from the standard output of a local script and passes it directly to the Monitor tool for execution. This mechanism of executing dynamically generated commands from external script output is a significant security risk as it allows a process to determine subsequent shell commands at runtime without oversight.
[INDIRECT_PROMPT_INJECTION]: The skill processes and displays research reports generated by a remote Gemini agent, which is an untrusted external source.
Ingestion points: Untrusted report data is fetched from a remote agent via uv run ... status --run <run_id> --full (Phase 4).
Boundary markers: The skill provides no delimiters or instructions to the agent to ignore or isolate potentially malicious content within the report.
Capability inventory: The agent has access to Bash (restricted to uv), Monitor, and Read tools, which could be abused if the agent is influenced by malicious instructions in the research report.
Sanitization: No filtering, validation, or sanitization of the remote report content is performed before it is presented or processed.

research