The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses herdr and ps to manage terminal sessions. In Relay mode, it dynamically constructs a shell command using session arguments: herdr pane run "$new" "$launch '/pickup <focus args, if any>'". This pattern introduces a risk of command injection if the focus arguments provided by the user are not correctly sanitized or quoted by the agent logic before execution.\n- [COMMAND_EXECUTION]: The skill executes ps -o args= -p $PPID to capture the command line of the parent process. Inspecting and reusing shell execution strings can be exploited to propagate or manipulate context across sessions.\n- [EXTERNAL_DOWNLOADS]: Setup instructions in the README suggest installing dependencies from a third-party GitHub repository (mattpocock/skills) using npx, which involves fetching and executing code from an external, untrusted source.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. It reads handoff documents from ~/.agents/handoffs/ which may contain malicious instructions or a "suggested skills" section that directs the agent to invoke specific tools. If these files are tampered with, they can control the agent's behavior in the new session.\n
Ingestion points: Reads files from ~/.agents/handoffs// or the OS temporary directory.\n
Boundary markers: None present; the agent is instructed to read the document in full and follow all referenced paths or URLs.\n
Capability inventory: Terminal pane management (herdr), process inspection (ps), version control (git), and the ability to invoke any other installed skill.\n
Sanitization: Lacks explicit validation or sanitization of document content before processing, relying only on a manual redaction instruction in the handoff creation step.\n- [DATA_EXFILTRATION]: The instruction to "follow the paths/URLs it references" within handoff documents could be used to trick the agent into sending sensitive data to attacker-controlled endpoints if the document content is compromised.

pickup