The Agent Skills Directory

[COMMAND_EXECUTION]: The skill performs dynamic execution of shell command output via eval "$($AGORA_REPORT session)" in SKILL.md. This pattern allows the agora CLI tool to generate and execute arbitrary code in the agent's shell environment at runtime, which poses a risk if the tool's output is compromised.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection by design, as it fetches and follows instructions from an external coordination server.
Ingestion points: External data is ingested through the $AGORA_REPORT inbox command described in SKILL.md.
Boundary markers: The instructions lack explicit delimiters or warnings to the model to ignore potentially malicious embedded instructions within the inbox items.
Capability inventory: The skill possesses capabilities for shell command execution (via eval) and file modifications (mentioned as 'risky or shared edits') in SKILL.md.
Sanitization: There is no evidence of validation or sanitization of the content retrieved from the Agora server before it is processed as user input.
[DATA_EXFILTRATION]: The skill transmits session details, task progress, and environment variables—including the AGORA_TOKEN—to a remote endpoint defined by AGORA_URL. If this URL is directed to an attacker-controlled server, it facilitates the exfiltration of sensitive project context and authentication credentials.

agora-reporting