The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts bulk-ingest.js and ingest.js use execSync to run shell commands with unsanitized input derived from URLs, text entries, or tags. This creates a high risk of command injection if an attacker provides a crafted input containing shell metacharacters.
Evidence in scripts/bulk-ingest.js: The script constructs a shell command string using inputArg and extraArgs without sufficient escaping and executes it via execSync.
Evidence in scripts/ingest.js: The script falls back to using curl via execSync when fetch fails, directly interpolating the url variable into the shell command string.
[DATA_EXFILTRATION]: The ingest.js script allows reading any local file that the user running the process has access to. While intended for local ingestion, this capability could be abused by a malicious agent or prompt to harvest sensitive system files.
Evidence in scripts/ingest.js: The script detects file paths in the input arguments and uses fs.readFileSync to read the entire content of the specified file.
[PROMPT_INJECTION]: The skill's primary function of ingesting and querying external data creates an indirect prompt injection surface.
Ingestion points: Content is ingested from arbitrary URLs and local files via scripts/ingest.js and scripts/bulk-ingest.js.
Boundary markers: None. Ingested content is stored directly in the database without delimiters or instructions for the agent to ignore embedded commands.
Capability inventory: The skill environment includes file read access and shell command execution capabilities.
Sanitization: Only basic HTML tag removal is performed in scripts/ingest.js; no sanitization is applied to the text content to prevent instruction injection.

knowledge-base