The Agent Skills Directory

[COMMAND_EXECUTION]: The /d365 search command interpolates user-provided keywords directly into a Python string literal within a python3 -c shell command. This enables an attacker to break out of the string context and execute arbitrary Python or shell code.
[COMMAND_EXECUTION]: Multiple commands, including /d365 ingest pdf, /d365 ingest dir, and /d365 dump, use unsanitized user input for file paths and document titles in shell templates. This creates a high risk of command injection through shell metacharacters.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. 1. Ingestion points: Data is collected from external websites via WebSearch and from user-uploaded documents. 2. Boundary markers: No delimiters or instructions are used to distinguish data from agent instructions. 3. Capability inventory: The skill has the ability to execute bash scripts and write to the file system. 4. Sanitization: There is no validation or security filtering of external content. Malicious instructions hidden in conference abstracts or ingested files could hijack the agent's behavior during improvement or ingestion cycles.
[DATA_EXFILTRATION]: Advisory outputs are automatically synchronized to the vendor's web dashboard at nukasoft.ai using a local synchronization script.

d365