The Agent Skills Directory

[COMMAND_EXECUTION]: The instructions direct the agent to perform shell operations (mkdir -p, cp, cmp) using a directory path (DIR) and file paths extracted directly from user input ($ARGUMENTS). The manual parsing logic described—removing quotes and handling backslash-escaped spaces—is highly susceptible to errors. If the agent fails to properly sanitize these strings before interpolating them into shell commands, it could lead to command injection.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted content from both the command arguments and the contents of local files specified by the user. It explicitly instructs the agent to treat this data as the 'authoritative text' of the problem and reason through it without safety filters or boundary markers mentioned.
Ingestion points: User-provided text in the invoking message and the contents of local files specified by absolute or relative paths.
Boundary markers: None. The skill instructs the agent to read the problem text 'verbatim' and treats it as the core task, which could allow embedded instructions to hijack the reasoning process.
Capability inventory: The skill has access to file system operations (mkdir, cp, cmp, view_file, write_to_file) and shell command execution (run_command).
Sanitization: There is no validation or sanitization of the input content or the file paths beyond checking for existence.
[DATA_EXPOSURE]: The skill allows a user to provide an arbitrary file path for the agent to read under the guise of it being a 'problem file'. The agent is instructed to use view_file to read this content in full. This capability can be exploited to trick the agent into reading sensitive files (e.g., .env, SSH keys, or configuration files) and potentially outputting their contents into the notes.md or proof.md files.

solo