The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions provide shell command templates that directly interpolate raw user messages and project data into command-line arguments. For example, SKILL.md contains python3 "$L" route "<the user's whole message>", and references/intake.md lists commands like python3 "$P" set 'audience="<user_input>"'. This pattern is highly susceptible to command injection if a user provides input containing shell metacharacters such as semicolons, backticks, or command substitutions.
[DYNAMIC_EXECUTION]: The skill implements features that allow for the dynamic creation and modification of other AI agent skills at runtime. It includes commands to write new skill files (styleskill.py write) and to append rules to existing skills (skillrules.py add) based on untrusted user feedback provided through the "Improve with feedback" or "Make a new skill" interfaces. This capability allows user input to permanently alter the agent's logic and behavior.
[INDIRECT_PROMPT_INJECTION]: The skill's workflow involves reading and acting upon multiple external, user-controlled files, creating a significant attack surface for indirect prompt injection.
Ingestion points: The agent reads and follows instructions from instructions.md, likes.md, script.md, assets.json, and broll.json during the video processing pipeline.
Boundary markers: There are no instructions to use delimiters or ignore-embedded-instructions warnings when processing these untrusted files.
Capability inventory: The agent possesses high-privilege capabilities, including shell command execution, network operations, and the ability to modify its own instructions/skills.
Sanitization: The instructions do not mention any sanitization or validation of the content of these external files before they are used to guide the agent's actions.
[EXTERNAL_DOWNLOADS]: The skill performs network operations to fetch assets from user-provided URLs using links.py fetch. Additionally, it includes a software update mechanism (update.py market) that downloads and installs updates for vendor-provided tools from the nextwork marketplace.
[CREDENTIALS_UNSAFE]: The skill includes a feature to download content from authenticated sites by accessing the user's browser profile for session cookies (via the --cookies-from-browser flag). While this is presented as a feature with user consent, the combination of browser profile access with the existing command injection vulnerabilities creates a risk of sensitive credential exposure or exfiltration.

start