The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute external CLI tools lev find and cass for searching session history and local data. It uses shell command patterns with variable interpolation, such as lev find "<query>" and cass search "<query>", which could be vulnerable to command injection if input is not properly handled.
[DATA_EXFILTRATION]: Accesses the directory ~/.agents/diagrams in the user's home folder. While these appear to be application-specific files, accessing hidden directories in the home path constitutes data exposure.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests and summarizes untrusted markdown files from the repository (.lev/pm/, docs/, etc.) without explicit boundary markers or sanitization.
Ingestion points: Reads various .md files throughout the repository tree and documentation folders.
Boundary markers: Absent; no specific instructions are provided to ignore embedded commands or instructions within the evidence files.
Capability inventory: The skill has the ability to read files, search session history, and execute specific CLI tools (cass, lev).
Sanitization: None; the content is synthesized directly into a provenance report.

prior-art