The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute multiple shell commands on the host system, including uv run to execute local Python scripts (main.py and ferment.py), mkdir for directory creation, and printf for appending data to history files. These operations involve direct interaction with the underlying operating system and represent a high risk for local environments.
[DATA_EXFILTRATION]: Accesses and reads files within sensitive local directories, specifically /Users/mtm/Documents/Obsidian Vault. Accessing user document folders without explicit authorization for each file represents a significant data exposure risk. Furthermore, the logic used to resolve the 'Zephyr key' to a filename (bake log M-D-YYYY-N.md) is potentially vulnerable to path traversal if the user-supplied key contains directory navigation characters (e.g., ../).
[INDIRECT_PROMPT_INJECTION]: The skill processes content from 'bake logs' which are external Markdown files (Obsidian notes). This creates an attack surface where malicious instructions embedded in these notes could influence the agent's behavior during processing.
Ingestion points: Markdown files located in /Users/mtm/Documents/Obsidian Vault.
Boundary markers: No delimiters or safety warnings are used when reading and parsing these external files.
Capability inventory: The agent has the ability to execute shell commands (uv run), create directories (mkdir), and write to files (printf).
Sanitization: No evidence of sanitization or validation of the content extracted from the bake logs is provided.
[DYNAMIC_EXECUTION]: The skill dynamically constructs and executes shell commands by interpolating variables (such as START time and the zephyr key) derived from user input and the content of local files. Executing logic assembled from untrusted or external file content is a common vector for code injection.

bulk-ferment-remaining