The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses shell scripts to execute sqlite3 queries with variables directly interpolated into the command strings.
Evidence in SKILL.md: The use of WHERE (p.data LIKE '%keyword1%') inside a sqlite3 bash call creates a command injection risk if the AI agent extracts keywords from a malicious user prompt without sanitization.
[INDIRECT_PROMPT_INJECTION]: The skill reads and processes session history which contains untrusted data (past user messages and assistant outputs).
Ingestion points: The skill reads data from ~/.local/share/opencode/opencode.db via sqlite3 calls in SKILL.md (Step 3 and 4).
Boundary markers: None identified; the skill instructs the agent to "Decode each JSON blob and reconstruct the conversation."
Capability inventory: The skill has the capability to execute shell commands (sqlite3, git, pwd) and read local files (the SQLite DB).
Sanitization: There is no evidence of sanitization or escaping of the recovered session content before it is processed by the assistant.
[COMMAND_EXECUTION]: The skill constructs file paths using environment variables like $HOME and $CURRENT_DIR in shell commands, which is a standard pattern but requires careful handling of paths with special characters.

session-history