The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill instructions define shell command templates that directly interpolate raw user-supplied strings into executable commands without sanitization.
Evidence: Step 0 uses python3 harness/scripts/mem-rank.py retrieve "<câu hỏi>" --k 5 to query memory.
Evidence: Step 8 uses python3 harness/scripts/query-log.py --record --question "<câu hỏi>" ... for telemetry logging.
A malicious user could provide a query containing shell metacharacters (e.g., ;, $(...), or backticks) to execute arbitrary code on the host system.
[COMMAND_EXECUTION]: The skill relies on shell-based execution for core logic, including the use of ripgrep with user-influenced terms (rg -c '<term>' wiki/). Without proper escaping, this presents a risk of command injection or unauthorized file access through tool flags.
[PRIVILEGE_ESCALATION]: Step 3b explicitly directs the agent to execute a script from the user's home directory (python3 ~/.claude/harness/harness/scripts/wiki-sync.py) if the local version is missing. Reaching outside the project root to execute global scripts is a privilege escalation pattern that can be used to bypass directory-level security constraints.
[INDIRECT_PROMPT_INJECTION]: The skill operates as an ingestion and synthesis engine for untrusted external data with high-privilege capabilities.
Ingestion points: Processes content from wiki/ markdown files and raw/ source files.
Boundary markers: No explicit delimiters or instructions are provided to the agent to treat wiki content as untrusted data or to ignore embedded instructions during synthesis.
Capability inventory: The skill possesses the ability to read and write files (wiki/index.md, wiki/log.md, and new page creation) and execute local Python scripts.
Sanitization: There are no sanitization or validation steps for the data retrieved from the wiki or raw sources before it is used to generate responses or create new persistent files.

query