The Agent Skills Directory

[OBFUSCATION]: The file pocket-planning.skill is a binary ZIP archive containing skill assets. Distributing a skill as a binary blob is an obfuscation technique that prevents plain-text auditing of the instructions and scripts being executed by the agent.
[REMOTE_CODE_EXECUTION]: The skill instructs the agent to run npx -y pocketto-pi in Phase 7 of SKILL.md. This command downloads and executes code from the public npm registry without user confirmation or a pinned version, creating a direct vector for arbitrary remote code execution.
[COMMAND_EXECUTION]: The skill executes several shell commands, including git log and npx, which could be exploited if the inputs derived from spec files are maliciously crafted.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from spec files (docs/pocket/spec/...) to generate execution plans and commands. A malicious spec file could contain hidden instructions designed to hijack the agent's behavior.
Ingestion points: The agent reads the spec file at docs/pocket/spec/{date}-{slug}/topic.md in Phase 0 and Phase 1 of SKILL.md.
Boundary markers: The instructions do not define clear boundaries or 'ignore embedded instructions' warnings for the data ingested from the spec file.
Capability inventory: The skill has the ability to execute git log, run npx commands, and perform file system operations.
Sanitization: There is no evidence of sanitization or escaping of the spec content; the skill relies on a 'Spec Reviewer' subagent which is itself vulnerable to prompt injection.
[EXTERNAL_DOWNLOADS]: The skill performs external downloads from the npm registry via the npx command.
[DYNAMIC_EXECUTION]: The skill uses npx to dynamically load and execute the pocketto-pi tool at runtime.

pocket-planning