The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill parses and executes shell commands stored in the .konteksto/tooling.md file (specifically the 'Repo orientation command' and 'Locate command'). This allows for execution of arbitrary code if the project repository contains malicious configuration files.
[INDIRECT_PROMPT_INJECTION]: The skill reads project records and role protocols from the .konteksto/ directory and adopts them as governing rules for the agent. This creates a large surface for attackers to inject malicious instructions that the agent is explicitly told to follow for the remainder of its session.
Ingestion points: Multiple markdown files including .konteksto/project-overview.md, .konteksto/roles/*.md, and .konteksto/tooling.md as described in SKILL.md.
Boundary markers: None. The instructions explicitly tell the agent to "apply it for the rest of the session" and "follow the ownership, approval, and routing rules recorded in the documents."
Capability inventory: The skill uses Bash, Read, Grep, and Glob tools.
Sanitization: No sanitization or validation of the ingested markdown content is performed before it is added to the agent context.
[COMMAND_EXECUTION]: The skill uses the Bash tool to run commands retrieved from project data files. While Bash is an allowed tool, the use of it to execute unvalidated strings provided by external project files constitutes a significant security risk if the repository is untrusted.

dev-context