The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the macOS say command via a bash shell to provide text-to-speech feedback. The agent's generated response is interpolated directly into the command string. While the instructions include a sanitization step to escape single quotes, this pattern remains vulnerable to command injection if the model fails to sanitize the output perfectly or if other shell-active characters are present.
[DATA_EXFILTRATION]: The skill records session summaries, including specific user errors and corrections, to a persistent storage system (mcp__serena). This externalizes user conversational data and learning progress to a memory service.
[PROMPT_INJECTION]: The memory persistence feature introduces a surface for indirect prompt injection. Because the agent reads past session data via mcp__serena__list_memories, a user could potentially provide malicious instructions during one session that are stored and then influence the agent's behavior in a subsequent session.
Ingestion points: User messages are processed and stored in eikaiwa_session_ and eikaiwa_vocab_ memory files.
Boundary markers: None explicitly defined for the memory content retrieved from the storage service.
Capability inventory: bash (via say), mcp__serena__write_memory, mcp__serena__list_memories (found in SKILL.md).
Sanitization: The skill provides logic to escape single quotes before passing text to the bash command, but no sanitization is mentioned for data retrieved from memory.

english-conversation