The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes arbitrary text from a repository (UI strings, documentation, and source files) while possessing high-privilege capabilities like file writing and command execution.
Ingestion points: Processes Thai text and UI strings extracted from the user's repository via the /thai commands.
Boundary markers: While it instructs the agent to preserve placeholders (e.g., %s, {{name}}), it lacks explicit delimiters or instructions to treat the ingested repository content as untrusted data, which could allow malicious instructions embedded in those files to influence agent behavior.
Capability inventory: The skill has access to Read, Write, Edit, and Bash tools, allowing it to modify the repository and execute shell commands.
Sanitization: There is no evidence of sanitization or filtering of the external repository content before it is interpolated into the agent's context.
[COMMAND_EXECUTION]: The skill utilizes the Bash tool to interact with the environment and manage its workflow.
Evidence: It executes git rev-parse --git-path to identify the repository structure and uses herdr agent prompt to communicate with other agents on the platform.
Context: It generates shell commands for the user, such as nvim <worksheet-path>, to facilitate manual review. It also manages temporary files in ${TMPDIR} for inter-agent communication.

thai-contextual-editor