The Agent Skills Directory

[COMMAND_EXECUTION]: The instructions direct the agent to execute shell commands (specifically grep) using user-provided input from $ARGUMENTS. This pattern creates a potential command injection vulnerability if the underlying platform does not properly sanitize or escape the user input before it is passed to the shell.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external JSON files (knowledge-graph.json) located in the project's data directory. If these files are maliciously crafted or modified by an attacker, they could contain hidden instructions intended to override agent behavior.
Ingestion points: .ua/knowledge-graph.json and .understand-anything/knowledge-graph.json.
Boundary markers: The instructions do not define clear delimiters or use "ignore embedded instructions" warnings when processing the graph content.
Capability inventory: The skill possesses shell execution capabilities (via grep and git) and the ability to read and display file contents.
Sanitization: No evidence of sanitization, validation, or escaping is present for the content extracted from the knowledge graph before it is presented to the agent context.

understand-chat