The Agent Skills Directory

[COMMAND_EXECUTION]: The SKILL.md instructions guide the agent to execute a shell command using the pattern python3 runner.py --query "QUERY_HERE". This design is highly vulnerable to command injection. If a user provides a query containing shell metacharacters (such as backticks, semicolons, or command substitutions like $()), the AI agent may inadvertently execute arbitrary code on the host machine while attempting to run the skill.
[CREDENTIALS_UNSAFE]: The runner.py script contains a hardcoded absolute file path /home/mph/Antigravity/Urithiru/.env which it attempts to read for an API key. Reaching into specific user home directories for sensitive files is a high-risk pattern that can lead to information disclosure or unauthorized access to credentials if the skill is executed in an environment where that path exists.
[DATA_EXFILTRATION]: The skill is designed to send all user queries to the OpenRouter API (https://openrouter.ai) and can optionally exfiltrate full execution traces (including prompts and responses) to an external Langfuse observability host. Users should be aware that their data is shared with multiple third-party LLM providers as part of the core functionality.
[PROMPT_INJECTION]: The skill processes untrusted user data and passes it to multiple LLMs, creating a large surface for indirect prompt injection.
Ingestion points: User input enters the system through the --query or --query-file arguments processed in runner.py.
Boundary markers: Absent. There are no clear delimiters used when interpolating user queries into the LLM system prompts to distinguish instructions from data.
Capability inventory: The skill can execute shell commands (SKILL.md), perform arbitrary network requests (runner.py), and write logs to the filesystem.
Sanitization: Absent. The query content is passed to external APIs without any escaping or filtering for malicious instructions.

urithiru