The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill's core purpose is to generate and register new agent skills and shell scripts at runtime based on discovered workflows. This process creates persistent executable artifacts in the agent's environment (~/.hermes/skills/), which could be leveraged to maintain malicious behavior if the generation logic is manipulated.
[INDIRECT_PROMPT_INJECTION]: The 'Passive Observation' mode (skills/observer/SKILL.md) reads and analyzes session transcripts to infer workflow patterns. These transcripts represent untrusted data that could contain hidden instructions designed to influence the agent's inference or the content of the generated skills.
Ingestion points: Current and historical session transcripts accessed via session_search and context scanning (referenced in skills/observer/SKILL.md).
Boundary markers: The inference logic uses a structured prompt but lacks explicit delimiters or instructions to ignore commands embedded within the session transcript data.
Capability inventory: write_file (writing scripts and skills), skill_manage (registering new capabilities), memory (persisting state), and session_search (reading transcripts).
Sanitization: There are no explicit instructions to sanitize or escape transcript content before it is processed by the inference engine.
[COMMAND_EXECUTION]: The skill generates shell scripts (e.g., kanban/board-setup.sh) from templates. These scripts incorporate user-supplied strings for bundle names and phase descriptions. While the skill lists 'shell_quote' as a compatibility requirement, the instructions for substituting values into templates do not explicitly enforce its use, creating a potential risk of command injection if the user provides crafted malicious input that is later executed in a shell environment.

workflow-architect