The Agent Skills Directory

[COMMAND_EXECUTION]: The skill constructs shell commands by interpolating user-provided task descriptions into a bash string. Evidence: jules remote new --repo <repo_name> --session "<user_task_description>" in SKILL.md. Risk: An attacker could craft a task description containing shell metacharacters (e.g., $(...), backticks, or quotes followed by other commands) to execute arbitrary code in the agent's environment.
[EXTERNAL_DOWNLOADS]: The skill downloads and installs external software and data. Evidence: npm install -g @google/jules in SKILL.md. Evidence: jules remote pull --session <session_id> > .jules/diff.patch in SKILL.md. Note: These resources are fetched from Google's official NPM package and domains.
[REMOTE_CODE_EXECUTION]: The skill applies code changes downloaded from a remote service to the local repository. Evidence: patch -p1 < .jules/diff.patch and git apply --index .jules/diff.patch in SKILL.md. Risk: Applying unverified diffs could introduce malicious code. The skill includes a mitigation step where the agent is instructed to examine the first 500 lines and seek user confirmation before applying.
[PROMPT_INJECTION]: The skill processes untrusted external data in the form of code diffs, creating an indirect prompt injection surface. Ingestion points: .jules/diff.patch (sourced from jules remote pull) in SKILL.md. Boundary markers: None present in the file content or instructions. Capability inventory: patch, git commit, git push, rm -rf in SKILL.md. Sanitization: None identified; the agent reads the file directly.
[DATA_EXFILTRATION]: The skill has the capability to modify and push content to remote repositories. Evidence: git push -u origin <branch_name> in SKILL.md. Risk: If the agent is compromised or misled by a malicious diff, it could be used to push sensitive project data to the remote origin.

jules