The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions in durable-work-guidance.md describe the use of shell commands (e.g., python <aegis-workspace-helper> new-work ...) that incorporate user-provided content such as task titles, outcomes, and scopes. Without explicit sanitization instructions for the agent, this creates a potential for command injection if malicious characters are included in these fields.
[INDIRECT_PROMPT_INJECTION]: The skill relies on reading external data sources, including user instructions, parent plans, and project context files, to determine the Task Intent and Resume Protocol. This ingestion of untrusted data, combined with the skill's ability to execute shell commands and modify the filesystem, creates a surface for indirect prompt injection attacks.
[INDIRECT_PROMPT_INJECTION]: Evidence Chain: (1) Ingestion points: SKILL.md (Start Protocol, Resume Protocol) specifies reading requested outcomes, parent plans, and CONTEXT.md. (2) Boundary markers: The skill does not define specific delimiters or instructions to sanitize external content. (3) Capability inventory: The skill performs filesystem writes to docs/aegis/work/ and executes shell commands via a Python helper script. (4) Sanitization: There are no documented procedures for sanitizing or validating inputs before they are used in commands.

long-task-continuation