The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands, specifically grep, using search terms derived directly from user input (e.g., <wrong claim terms>). If the agent fails to sanitize shell metacharacters in the user's input, this pattern allows for arbitrary command injection in the host environment.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user content and interpolates it into database write commands like gbrain remember and gbrain bootstrap interview. This data is then stored in long-term memory or rendered into core identity files (SOUL.md, USER.md). The lack of explicit boundary markers or sanitization logic creates a vulnerability where malicious instructions could be persisted and later executed or obeyed by the agent.
Ingestion points: User input triggers such as "that's wrong" or "correct that fact" (SKILL.md).
Boundary markers: None identified in the interpolation of user-provided facts into gbrain commands.
Capability inventory: Shell execution (grep), file modification (gbrain bootstrap), and database writes (gbrain remember, gbrain forget) (SKILL.md).
Sanitization: No sanitization or validation of the user's "corrected fact" is performed before storage.
[DATA_EXFILTRATION]: The skill's root-cause analysis process involves scanning and reading sensitive local files including USER.md, SOUL.md, and directories containing information about people/ and companies/. While necessary for the skill's function, this grants the agent access to high-value personal data which could be misused if the agent's context is compromised.

correction-pipeline