The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes project metadata and graph data from a local file, creating an attack surface for instructions embedded in data.
Ingestion points: The agent is instructed to read metadata and node information from .ua/knowledge-graph.json or .understand-anything/knowledge-graph.json (SKILL.md, Steps 3-6).
Boundary markers: The instructions lack explicit delimiters or instructions for the agent to ignore potential commands embedded within the graph's text fields, such as node summaries or tags.
Capability inventory: The skill has the ability to execute shell commands (git, grep) and write to the local filesystem ($UA_DIR/diff-overlay.json).
Sanitization: No sanitization is performed on the content read from the knowledge graph before it is incorporated into the agent's context.
[COMMAND_EXECUTION]: The skill instructions provide shell snippets that incorporate variables extracted from local project files.
Evidence: Step 3 utilizes a shell command GRAPH_COMMIT=$(git rev-parse --verify --end-of-options "${GRAPH_COMMIT_RAW}^{commit}" 2>/dev/null) to resolve a commit hash. While the instruction employs defensive programming like double quotes and the --end-of-options flag, it still executes logic based on data retrieved from the environment.

understand-diff