The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill uses the dynamic injection syntax in SKILL.md to execute shell commands at load time. This command (!ACTIVE=$(cat personas/_active.md ...)) runs automatically when the skill is initialized by the agent.
[COMMAND_EXECUTION]: The shell block executes local cat commands and utilizes variable assignment (ACTIVE=...) to determine which files to read into the agent's context. The lack of validation on the content of _active.md allows for potential path traversal if the variable is manipulated to include relative path sequences like ../../.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from persona.md files and incorporate it directly into the agent's active context. This creates a vulnerability surface where instructions embedded in those files could influence or override the agent's behavior.
Ingestion points: SKILL.md (via dynamic shell command loading persona.md content).
Boundary markers: Absent; the content is loaded as raw text into the prompt context.
Capability inventory: The skill allows the agent to read and append to files within the personas/ directory tree.
Sanitization: No filtering or validation is applied to the content of the persona files before injection.

interview