The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided conditions and actions and stores them in markdown files within the tracking path. This creates a surface for indirect prompt injection if an attacker-controlled input is saved and later processed as a trusted instruction by the agent.
Ingestion points: User inputs for 'condition' and 'action' are recorded into files under {config.paths.tracking}/.
Boundary markers: There are no explicit delimiters or 'ignore' instructions specified for the content of the generated tracking files.
Capability inventory: The skill reads and writes files across multiple sessions and directories.
Sanitization: No sanitization or instruction filtering is mentioned for the user-supplied 'action' field before it is retrieved for execution.
[COMMAND_EXECUTION]: The skill instructs the agent to perform the 'action' defined in the tracking file when conditions are met. If this action involves tool calls or shell commands, it could be leveraged for unintended command execution.
[TIME_DELAYED_CONDITIONAL]: The skill's core logic is gated by specific dates and verifiable conditions. Actions are only proposed or executed when the current date matches or exceeds the due date and the logic evaluates to true.

zmm-track