The Agent Skills Directory

[COMMAND_EXECUTION]: The cargo-ai context runtime execute command provides a mechanism for the agent to run arbitrary shell commands. While the documentation suggests this is limited to a sandbox containing a checked-out copy of the context repository, it allows for general inspection and operation using tools like grep, ls, and find.
[DYNAMIC_EXECUTION]: The troubleshooting guide explicitly suggests using sh -c to chain multiple operations, facilitating the dynamic creation and execution of shell scripts at runtime within the sandbox environment.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an inherent vulnerability to indirect prompt injection due to its reliance on processing data from untrusted external sources.
Ingestion points: Data enters the system via public website scraping (defined in references/examples/bootstrap-from-domain.md) and sales call transcripts (defined in references/examples/lifecycle.md).
Boundary markers: The skill does not enforce explicit boundary markers or provide instructions to the LLM to disregard potentially malicious commands embedded in the processed markdown content.
Capability inventory: The agent possesses tools for writing files (runtime write), editing files (runtime edit), and executing shell commands (runtime execute), all of which could be abused if an injection is successful.
Sanitization: There is no mention of sanitizing or validating the content scraped from the web or extracted from transcripts before it is stored in the knowledge base or processed by the agent.

cargo-context