The Agent Skills Directory

[COMMAND_EXECUTION]: The docs/conf.py file executes a system command using subprocess.Popen with shell=True to retrieve the current version information via git describe. While the command is static, the use of shell=True is a security best-practice violation.
[DYNAMIC_EXECUTION]: Multiple files, including README.md, docs/help.md, and docs/aliases.md, utilize cog blocks to dynamically execute Python code during documentation generation. These blocks perform operations such as running sphinx-build or invoking CLI commands through a test runner to embed live output into the documentation.
[INDIRECT_PROMPT_INJECTION]: As a tool designed to process and summarize external data (piped input, URL-based fragments, and file attachments), the skill is inherently susceptible to indirect prompt injection. This risk is particularly relevant when the model is granted access to tools or sensitive user keys. Mandatory Evidence Chain:
Ingestion points: untrusted data enters the agent context via standard input, -f/--fragment URLs or local files, and multi-modal attachments.
Boundary markers: The documentation suggests using system prompts (-s) to define constraints, but the tool does not enforce strict boundaries or sanitization on ingested content.
Capability inventory: The skill has the ability to execute Python functions as tools, manage API keys in keys.json, and interact with local SQLite databases (logs.db, embeddings.db).
Sanitization: No automated sanitization of external content is performed before it is interpolated into model prompts.
[EXTERNAL_DOWNLOADS]: The skill facilitates the installation of third-party plugins from PyPI via llm install and the fetching of remote templates and context fragments from arbitrary URLs. While these are documented core features for extensibility, they introduce a supply-chain risk factor.
[PROMPT_INJECTION]: Deterministic scanners flagged a potential DAN/jailbreak pattern in docs/plugins/directory.md. Technical review suggests this is a false positive triggered by documentation describing "uncensored models" available via specific third-party plugins (e.g., Venice AI).

llm