The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary purpose is to ingest untrusted data from the user conversation and process it via a shell command, creating a vulnerability surface for injection.
Ingestion points: User-provided text (decisions, preferences, insights) is captured from the conversation and used as the <memory content> value in the vault-cli capture command described in SKILL.md.
Boundary markers: There are no boundary markers or instructions telling the agent to treat the captured string as non-executable data or to ignore embedded shell instructions.
Capability inventory: The skill uses the Bash tool to execute vault-cli, providing a mechanism for command execution.
Sanitization: The instructions specifically recommend using double quotes (--text "<content>") to handle apostrophes. However, in most shell environments, double quotes allow for command substitution (e.g., $(...) or `...`) and variable expansion, which the instructions do not address or mitigate.
[COMMAND_EXECUTION]: The skill relies on constructing and executing shell commands that include user-supplied strings. The lack of specific sanitization or escaping guidance for the agent when handling these strings creates a risk of command injection if a user provides input containing shell metacharacters like semicolons, pipes, or command substitution markers.

vault-capture