The Agent Skills Directory

[COMMAND_EXECUTION]: The instructions in references/commands.md suggest using eval to handle multi-word command strings in shell environments. This recommendation introduces a command injection vulnerability if the agent incorporates unvalidated user input into the shell command string.
[DATA_EXFILTRATION]: This skill grants the agent extensive access to sensitive local data on macOS, including Apple Mail, iMessages, Contacts, and Calendar events. Because the tool also supports sending outgoing messages and emails (orchard mail send, orchard messages send), it creates a potential path for data exfiltration.
[PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection because it reads data from external communications and has the ability to execute sensitive actions.
Ingestion points: Untrusted data enters the agent context via orchard mail read and orchard messages read as described in SKILL.md.
Boundary markers: The instructions lack definitions for delimiters or warnings to ignore embedded instructions within retrieved content.
Capability inventory: The agent can perform high-impact actions including mail send, messages send, and shortcuts run (found in references/commands.md).
Sanitization: No specific sanitization or content validation procedures are defined for the ingested data.

orchard