The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's logging instructions in references/instructions/append-log-line.md direct the agent to use a shell command (printf with the >> append operator) to update the log.md file. This pattern introduces a risk of shell command injection if the content being logged—which is derived from user input or external files—contains shell-special characters such as single quotes that are not correctly escaped by the agent.
[DYNAMIC_EXECUTION]: The agent is required to dynamically assemble a shell command string by interpolating variable content into a predefined template. Constructing executable shell strings at runtime from external or user-provided data is a practice that can lead to unintended command execution if the input is not strictly validated or escaped.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to read and process 'pending decision bundles' from the .pending-decisions/ directory. As these files are primary inputs and can be authored by other (potentially untrusted) skills, they represent an entry point for data that could attempt to influence the agent's logic or exploit the logging mechanism.
Ingestion points: Files located in the .pending-decisions/ directory and interactive user chat responses.
Boundary markers: The instructions do not define explicit delimiters or 'ignore' warnings for the content that is eventually written to the log.
Capability inventory: The skill performs file writing via shell redirection (printf ... >> log.md) and is instructed to invoke other skills such as /change or the original bundle producer.
Sanitization: While the shell command template wraps content in single quotes, there are no instructions provided for escaping single quotes or other shell metacharacters that may be present within the content itself.

resolve-pending-decisions