The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a maintenance binary located at a hardcoded absolute path: /Users/jean-patricksmith/.local/bin/cass-maintain. Hardcoding specific user home directories in a shared skill is a security risk and limits portability.
[EXTERNAL_DOWNLOADS]: The skill directs the user to install a tool from a third-party Homebrew tap: brew install dicklesworthstone/tap/cass. This source is not a verified or well-known organization, representing an unverifiable external dependency.
[INDIRECT_PROMPT_INJECTION]: The skill processes and displays session transcripts, which constitutes an ingestion of untrusted data into the agent's context.
Ingestion points: cass search, cass view, and tail commands retrieve historical session data from files.
Boundary markers: There are no markers or instructions provided to the agent to treat the retrieved transcript content as untrusted or to ignore embedded instructions.
Capability inventory: The skill can execute various CLI tools and scripts, creating a risk if a transcript contains malicious instructions that the agent might follow.
Sanitization: The skill lacks mechanisms to sanitize or filter the content of session logs before presenting them to the agent.

cass