The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data through ticket prompts and thread transcripts that could contain malicious instructions designed to influence agent behavior. \n
Ingestion points: Data enters the agent context through sesh ticket send-prompt, sesh thread send, and transcript reads (sesh transcript). \n
Boundary markers: The documentation mentions the use of bracketed paste to preserve prompt structure but does not specify delimiters to segregate data from instructions for the LLM. \n
Capability inventory: The agent has access to file system operations, tmux session manipulation, and host command execution. \n
Sanitization: No explicit sanitization or filtering of external content is described for these ingestion points. \n- [COMMAND_EXECUTION]: The sesh plugins feature allows the daemon to execute commands on the host machine. \n
Evidence: The sesh plugins run command executes logic defined in local manifests at <SESH_HOME>/plugins/*.toml. While restricted to pre-defined manifests, this provides a mechanism for local command execution. \n- [DATA_EXFILTRATION]: The skill enables movement of files and metadata across a mesh of machines, creating a potential path for data exfiltration. \n
Evidence: sesh ticket move and sesh blob commands facilitate the transfer of content-addressed files and ticket data between peer daemons in the mesh. sesh fs list provides directory enumeration capabilities, though it is restricted to home-rooted paths. \n- [DYNAMIC_EXECUTION]: The plugin architecture allows for runtime execution of host capabilities based on configuration files. \n
Evidence: The daemon declaration for list and action plugins allows for dynamic mapping of JSON output to UI items and substitution of ARGV for command execution.

sesh-cli