The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands using bun scripts/db/query.ts with arguments like <name> and <slug> that are parsed directly from the GTD.md file. This pattern is vulnerable to shell command injection if a task item contains malicious characters (e.g., ; rm -rf /). This occurs in SKILL.md and workflows/outreach.md.
[PROMPT_INJECTION]: The skill processes untrusted data from GTD.md to determine which workflows to run. This creates an indirect prompt injection surface where a maliciously crafted task could override the agent's logic or force it to execute unintended commands.
Ingestion points: Reads task items from @GTD.md (specified in SKILL.md).
Boundary markers: None identified; task text is processed directly.
Capability inventory: Executes shell commands (bun), reads/writes files in private directories, and potentially sends messages via Gmail/Telegram.
Sanitization: No evidence of input escaping or validation before passing data to shell commands or prompt interpolation.
[DATA_EXFILTRATION]: The skill reads from and writes to highly sensitive locations, including ~/CybosVault/private/content/work/, ~/CybosVault/private/context/calls/, and private entity notes. While this is functional for a GTD skill, the access to private interaction history combined with unvalidated command execution poses a significant risk to data privacy.

gtd