The Agent Skills Directory

[COMMAND_EXECUTION]: The TerminalCapture implementation pattern in references/implementation-patterns.md utilizes subprocess.run(command, shell=True). This is a significant security risk as it allows for arbitrary shell command injection if the command string is derived from untrusted agent output or external data.- [PERSISTENCE]: The skill defines a persistent memory pattern ('Learning Through Self-Modification') that uses a PreferenceStore class to write agent-learned data to agent/preferences.yaml. This mechanism allows instructions or behavioral changes to persist across different agent sessions, which can be exploited to maintain malicious state.- [INDIRECT_PROMPT_INJECTION]: The skill focuses on offloading large tool outputs and terminal logs to the filesystem for later retrieval, which creates a large attack surface for indirect prompt injection.
Ingestion points: Untrusted tool outputs are stored in scratch/tool_outputs/, and terminal logs are stored in terminals/.
Boundary markers: There are no boundary markers or instructions provided to the agent to treat this retrieved content as untrusted data.
Capability inventory: The skill enables file write operations and shell execution (through the terminal pattern).
Sanitization: No content sanitization or filtering is applied to the data written to or read from the filesystem before it is injected back into the agent context.- [DYNAMIC_EXECUTION]: The SkillLoader pattern in references/implementation-patterns.md loads and injects markdown-based instructions from SKILL.md files at runtime. This dynamic loading of system instructions can lead to unauthorized behavioral changes if the underlying files are compromised.

filesystem-context