The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies extensively on executing complex shell commands locally and on a remote host via SSH to synchronize files and manage background processes.
[DATA_EXFILTRATION]: The skill's primary function is a data movement operation that copies the user's conversation transcripts and repository content to an external host provided as an argument. This represents a high-impact exfiltration vector for sensitive development data and history.
[DYNAMIC_EXECUTION]: The skill constructs shell commands by interpolating variables such as the branch name, session ID, and repository path directly into command strings. These variables are not sanitized or escaped before being passed to a shell (e.g., inside single quotes in an SSH call), which allows for command injection if project metadata contains shell metacharacters like semicolons or single quotes.
[INDIRECT_PROMPT_INJECTION]: The skill processes session transcript files that may contain untrusted content. Ingestion points: Reads the conversation transcript file (.jsonl) from the local projects directory. Boundary markers: None; the transcript is processed as a raw text stream. Capability inventory: Uses sed for text transformation and pipes the output to a remote cat command via SSH. Sanitization: None; the skill uses a pipe character as a delimiter for a sed substitution command involving path variables, which can lead to local command injection if directory names contain the delimiter.
[PERSISTENCE]: The skill explicitly establishes persistence on the remote host by modifying the pins.json file in the agent's configuration directory, ensuring that the background session process is automatically respawned by the supervisor daemon if it terminates.

trebuchet