The Agent Skills Directory

[COMMAND_EXECUTION]: Potential shell command injection in the search step. The skill instructions direct the agent to execute grep -ril "<từ khoá>" using keywords extracted directly from user queries. Maliciously crafted input containing shell metacharacters (e.g., ;, |, &&, or backticks) could be used to execute arbitrary commands on the underlying system.
[PROMPT_INJECTION]: Indirect prompt injection surface identified.
Ingestion points: The skill reads file contents from .knowhow/wiki, .knowhow/skills, and .knowhow/workflows.
Boundary markers: Absent; there are no instructions or delimiters defined to prevent the agent from following malicious commands that might be embedded within the files being queried.
Capability inventory: The skill possesses extensive capabilities including shell command execution (ls, grep) and file system write access to .knowhow/schema-signals.md, the inbox/ and raw/ directories, and arbitrary user-specified paths during its 'teach' mode.
Sanitization: Absent; data retrieved from external files is processed and used to generate responses and new files without escaping or validation.

knowhow-query