The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses sed in a shell pipeline to substitute placeholders within template files using data extracted from project manifests like package.json. If this project metadata contains shell-special characters or the | delimiter, it could lead to improper command execution or corrupted file contents. The skill documentation includes a manual guardrail for the agent to avoid this when detected.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted project data to populate its knowledge bundle, creating a surface for potential injection. Ingestion points include project manifests (package.json, pyproject.toml, etc.), README.md, and CODEOWNERS files parsed in Step 0. No explicit delimiters or instructions to ignore embedded commands are present during interpolation. The capability inventory includes file writes and shell execution (sed, grep, uv, just) in SKILL.md, templates/justfile, and templates/scripts/knowledge-librarian.sh. A manual warning for the sed delimiter in SKILL.md Step 1 serves as a partial sanitization step.
[DYNAMIC_EXECUTION]: The scaffolded automation includes a shell script (knowledge-librarian.sh) that executes a command provided by the AGENT_CLI environment variable. This allows the execution of arbitrary commands within the repository's environment or CI system, depending on how the variable is configured by the user.
[PRIVILEGE_ESCALATION]: The skill applies executable permissions (chmod +x) to the newly created knowledge-librarian.sh script. While routine for scaffolding an automation tool, this constitutes a modification of file permissions on dynamically generated content.

lokf-scaffolding