The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a shell command python3 harness/scripts/mem-rank.py retrieve "<câu hỏi>" --kind-filter episode where <câu hỏi> is substituted with direct user input. Although the input is wrapped in double quotes, this pattern remains susceptible to shell metacharacter injection (such as backticks or command substitution) depending on the underlying shell and the agent's sanitization logic.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from various wiki files and passes a summary to a subagent, creating a surface for indirect prompt injection where malicious instructions embedded in the wiki content could influence the agent's behavior.
Ingestion points: Reads data from wiki/index.md, wiki/stale.json, and individual wiki pages (e.g., concepts/*.md).
Boundary markers: No explicit delimiters or boundary markers are defined to isolate untrusted wiki data from the agent's internal instructions.
Capability inventory: Spawns a subagent (Explore/general-purpose) and executes a local Python script via subprocess.
Sanitization: There is no mention of escaping, validation, or sanitization of the content retrieved from the wiki files before it is used to generate the conclusion or passed to the subagent.

wiki-room