The Agent Skills Directory

[DATA_EXPOSURE]: The skill accesses sensitive environment configuration files located in the user's home directory to resolve workspace paths.
Evidence: resolve-store.sh reads ~/.claude/session.env to determine the SESSION_ROOT value.
[COMMAND_EXECUTION]: The skill executes multiple system commands and binaries to manage its state and data store.
Evidence: resolve-store.sh executes git commands (e.g., git rev-parse, git diff) to monitor the state of the decision repository.
Evidence: SKILL.md and check.sh invoke node with experimental flags (--experimental-strip-types) to execute TypeScript-based rendering and validation logic.
[DYNAMIC_EXECUTION]: The skill performs runtime compilation of its own source code and executes arbitrary JavaScript snippets via the shell.
Evidence: render/build.ts uses execFileSync to run tsc (TypeScript compiler) to generate client-side scripts from page.ts and view-model.ts for inlining into a template.
Evidence: resolve-store.sh and check.sh use node -e to execute dynamically generated JavaScript for processing file content and JSON data.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user data in the form of session JSON, which is then re-processed by the agent and rendered into artifacts, creating a vulnerability surface for instruction injection.
Ingestion points: session.json is read by the render.ts utility and its content is interpolated into both HTML and Markdown artifacts.
Boundary markers: The skill does not implement clear delimiters or instructions to ignore potential commands embedded within the session data.
Capability inventory: The agent has the capability to write to the file system (artifacts) and execute shell commands via the provided scripts, which could be abused if malicious instructions are successfully injected into the session state.
Sanitization: render.ts provides minimal sanitization by escaping < characters in the JSON payload, but this is insufficient to prevent high-level prompt injection attacks.

grilling