The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's instructions direct the agent to execute shell commands like gbrain and grep using strings derived from user input. Placeholders such as "<relevant terms>" are used in these commands. If the user input contains shell metacharacters like backticks or command substitution sequences, it could lead to arbitrary command execution on the host system.
[PROMPT_INJECTION]: The skill facilitates an indirect prompt injection surface by ingesting user corrections and writing them into identity files (SOUL.md, USER.md) and 'brain' repository pages. 1. Ingestion points: Data enters the context via trigger phrases like 'that's wrong' or 'correct that fact'. 2. Boundary markers: The skill uses double quotes in shell commands and source tags in repo edits as delimiters, which are insufficient against adversarial input. 3. Capability inventory: The agent has capabilities to execute shell commands, perform filesystem writes, and mutate a persistent database via gbrain. 4. Sanitization: There is no explicit sanitization, validation, or filtering of the user-provided correction content before it is stored or used in queries.
[DATA_EXPOSURE]: The skill processes sensitive user context by searching through identity records and workspace memory files. While core to its function, this workflow involves broad access to private user information stored in the harness environment.

correction-pipeline