The Agent Skills Directory

[COMMAND_EXECUTION]: The cancel_self_followup tool in handler.ts accepts an id parameter that is used to construct file system paths without apparent sanitization. Specifically, the cancelOne method uses this id to build source and destination paths via the entryPath helper, which are then passed to fs.renameSync and fs.readFileSync. This presents a directory traversal risk, potentially allowing an attacker to manipulate or read files outside the designated pending and cancelled storage directories.
[INDIRECT_PROMPT_INJECTION]: The skill allows the agent to schedule future tasks by storing free-text prompts that are re-injected into the agent's context as heartbeats at a later time. 1. Ingestion points: The prompt parameter in schedule_self_followup and schedule_room_followup tools. 2. Boundary markers: None; the heartbeat mechanism does not wrap the scheduled content in delimiters or safety instructions. 3. Capability inventory: The agent processing the heartbeat has access to all available tools and memory operations. 4. Sanitization: None; prompts are stored and retrieved as raw text, creating a surface for cross-session instruction injection.
[PRIVILEGE_ESCALATION]: The lack of validation on the id parameter in cancel_self_followup could be exploited to affect the state of other users' follow-ups if the underlying file storage structure is shared or predictable, leading to unauthorized modification of the task queue.
[METADATA_POISONING]: There is an inconsistency between the skill manifest and its actual implementation. The schedule_room_followup tool is fully defined and implemented in the source code but is missing from the tools list in the SKILL.md YAML frontmatter, which obscures the skill's full capability set from automated manifest analysis.

self-scheduling