The Agent Skills Directory

[COMMAND_EXECUTION]: The instruction in SKILL.md directs the agent to execute a shell command: pnpm -C packages/reconstituter opencode-sessions search "<query>" --k 10. The <query> placeholder is intended to be replaced with user-provided text. This pattern is highly vulnerable to command injection if the user input contains shell-active characters like backticks, semicolons, or command substitution syntax (e.g., $(...)). An attacker could craft a query that executes arbitrary commands on the agent's host system.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted search queries from users and pass them to a high-capability command-line tool.
Ingestion points: SKILL.md (via the 'Search query' input field).
Boundary markers: The command uses double quotes ("<query>") which provides minimal protection against simple whitespace separation but does not prevent subshell execution or quote-escaping attacks.
Capability inventory: The skill has access to shell execution via pnpm and access to local session data and paths.
Sanitization: There is no instruction to sanitize, escape, or validate the user input before it is interpolated into the shell command string.

opencode-semantic-find-session