The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands (grep, xargs, cat) using interpolated variables derived from files in the repository.
Evidence: grep -l "<path-to-current-summary>" .kb/decisions/ and grep -l "<summary-path>" .kb/decisions/ | xargs -I {} sh -c 'echo "## {}"; cat {}'.
Risk: If a file path or name within the knowledge base contains shell metacharacters (e.g., ;, |, `), it could lead to arbitrary command execution when processed by the shell.
[DATA_EXFILTRATION]: The skill is designed to discover and read various files within the project structure based on content found in the .kb/ directory.
Evidence: Steps 1 through 5 detail a recursive discovery process starting from _root.md and following references to summaries and decision records.
Risk: An attacker who can influence the content of the .kb/ directory could direct the agent to read sensitive project files outside the intended knowledge base scope.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from the repository without explicitly defining boundary markers or sanitization procedures.
Ingestion points: Reads markdown files from .kb/indexes/, .kb/summaries/, and .kb/decisions/.
Boundary markers: Absent. The skill does not instruct the agent to ignore or delimit instructions found within these files.
Capability inventory: Can execute shell commands (grep, cat), read files, and answer user questions based on the content.
Sanitization: Absent. There is no logic to validate or escape the content of the knowledge base files before they are processed by the agent.

kb-query