The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill instructions for 'consume' mode direct the agent to execute computations defined within OKF bundles (specifically concepts of type Attested Computation). Although the specification suggests these for structured data queries (SQL, dbt), the format allows for arbitrary runtimes and executors. This capability could be exploited to run malicious code embedded in an untrusted bundle.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process 'knowledge bundles' as primary context for agent tasks. These bundles consist of markdown files, which provide an attack surface where malicious instructions could be embedded to influence the agent's behavior.
Ingestion points: OKF bundles containing .md and index.md files are read into the agent's context.
Boundary markers: While YAML frontmatter separates metadata, there are no explicit instructions to the agent to treat the markdown body as untrusted or to ignore embedded commands.
Capability inventory: The agent is granted access to the Bash, Write, Edit, and Read tools, providing high-impact capabilities for any successful injection.
Sanitization: The skill does not perform sanitization or validation of the ingested markdown body before the agent processes it as context.
[COMMAND_EXECUTION]: The skill instructions and internal scripts utilize the uv run command to execute Python scripts (such as okf_init.py and a validation script located in a sibling directory). While these specific scripts appear to be benign internal tools, the reliance on shell execution for core functionality increases the overall risk profile if arguments or paths were to be influenced by untrusted data.

okf