The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/gate-all.mjs performs dynamic code execution by scanning the parent directory for folders starting with the khe- prefix. It then identifies and executes any Node.js scripts matching the *-check.mjs pattern within those directories using child_process.spawnSync. This involves executing code from paths computed at runtime, which is a known vector for potential privilege escalation or code execution if the local environment is compromised.
[COMMAND_EXECUTION]: The skill uses Node.js subprocesses via spawnSync to run internal validation scripts and 'self-test' commands for other installed skills in the collection.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to interpret arbitrary user requests and route them to other tools, creating a surface for indirect prompt injection. Ingestion points: Untrusted data enters the agent context through the initial user request as defined in SKILL.md. Boundary markers: Present; the skill mandates a strict, four-part output format (Goal:, Route:, Work:, Not verified:) to isolate logic. Capability inventory: Subprocess execution and filesystem operations are performed in scripts/gate-all.mjs and scripts/route-check.mjs. Sanitization: Present; the workflow requires a 'Fresh-eye review' process (specified in references/review.md) where a second pass validates the routing against the original request, explicitly withholding the initial agent's reasoning to prevent bias or injection propagation.

khe-auto