The Agent Skills Directory

[COMMAND_EXECUTION]: The Init operation in SKILL.md instructs the agent to create a directory structure by interpolating a user-provided or confirmed list of categories directly into a shell command: mkdir -p kb/raw/sources kb/raw/assets kb/wiki/{category1} kb/wiki/{category2} .... This pattern is vulnerable to command injection if a category name contains shell metacharacters (e.g., ;, &&, |), allowing for arbitrary code execution.
[PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection (Category 8) during the Ingest operation. The instructions in SKILL.md direct the agent to read untrusted source documents from kb/raw/sources/ and incorporate their content into the wiki without utilizing boundary markers or providing instructions to ignore embedded commands. This allows malicious source documents to potentially override agent behavior.
Ingestion points: Files located in kb/raw/sources/ as specified in SKILL.md and assets/schema.md.
Boundary markers: Absent. The skill does not use delimiters or specify that source content should be treated as untrusted data.
Capability inventory: The agent can execute shell commands (via mkdir and the bun scripts) and perform file system writes (via scripts/lib/kb.ts and scripts/map.ts).
Sanitization: Absent. Source material is read and processed directly by the agent to update the knowledge base.
[PROMPT_INJECTION]: The Query and Map operations in SKILL.md and scripts/map.ts implement a feedback loop where AI-synthesized content or connections are automatically filed back into the wiki. This mechanism can facilitate the persistence and propagation of malicious content if the knowledge base has been previously poisoned via an indirect prompt injection attack.

kb-wiki