The Agent Skills Directory

[COMMAND_EXECUTION]: The skill defines shell commands for interacting with local CLIs using the pattern claude -p "{{ARGUMENTS}}" and gemini -p "{{ARGUMENTS}}". These commands interpolate user-provided data directly into a shell execution context without any visible sanitization or escaping mechanisms.\n- [COMMAND_EXECUTION]: The use of shell interpolation for untrusted user input allows for arbitrary command execution. A malicious user or an indirect prompt injection could provide input containing shell metacharacters (e.g., ;, &, |, `, $()) to break out of the intended command and execute unauthorized processes or access sensitive files on the host system.\n- [PROMPT_INJECTION]: The skill lack explicit boundary markers or instructions for the agent to treat {{ARGUMENTS}} as untrusted data. This makes it highly susceptible to indirect prompt injection where data processed by the agent could contain shell-escape payloads.\n- [COMMAND_EXECUTION]: Mandatory Evidence Chain for Indirect Injection Risk:\n
Ingestion points: {{ARGUMENTS}} variable in SKILL.md used in shell command templates.\n
Boundary markers: Absent; no delimiters or "ignore instructions" warnings are present around the user input placeholder.\n
Capability inventory: Execution of arbitrary shell commands via claude and gemini binaries, and file-write capabilities to the .omw/ask/ directory.\n
Sanitization: Absent; the skill does not specify any validation, filtering, or escaping for the interpolated arguments.

ask