The Agent Skills Directory

[COMMAND_EXECUTION]: The skill constructs file paths and shell commands using unvalidated provider names. In SKILL.md (Step 1), the provider name p is used to create the path qf="$Q-$p.txt", which is then used as a target for shell redirection (> "$qf"). If a provider name contains path traversal sequences like ../, an attacker could overwrite arbitrary files. In agent-prompt-template.md, the provider name {PROVIDER} is interpolated directly into a bash command: bash "{PLUGIN_ROOT}/scripts/providers/{PROVIDER}.sh". This enables unauthorized script execution if the provider name is manipulated to include shell metacharacters.
[PROMPT_INJECTION]: In SKILL.md (Step 2), provider names are interpolated into the system prompt for the analyst agents: You are the council analyst for the provider "${p.name}".. A malicious provider name could contain injection payloads designed to hijack the analyst agent's instructions.
[INDIRECT_PROMPT_INJECTION]: The skill processes responses from external AI providers, creating an attack surface where an external model's output could influence the analyst agent's behavior.
Ingestion points: The analyst agent reads the output of provider scripts in agent-prompt-template.md (Round 1).
Boundary markers: There are no explicit delimiters or safety instructions provided to the analyst agent to treat the provider's response as untrusted data.
Capability inventory: The analyst agent has capabilities to execute shell commands (bash) and write files (cat > ...) to perform follow-up queries and report results.
Sanitization: Quoted heredocs (<<'COUNCIL_Q_EOF') are used in agent-prompt-template.md to prevent shell injection from the content of follow-up questions, but this does not prevent the agent from being logically manipulated into performing unintended actions.
[DYNAMIC_EXECUTION]: The skill uses a dynamic workflow in SKILL.md (Step 2) that executes a Javascript-based script to coordinate parallel agent execution, which involves runtime assembly of instructions and logic.

deep-execution