The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides instructions for the agent to execute shell commands with user-interpolated variables, such as rg -n -i "<topic|product|resource|claim>". This creates a risk of command injection if the user provides malicious input that escapes the search string.
[INDIRECT_PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection by ingesting live data from external sources (X.com) into its voice corpus.
Ingestion points: Data is collected from https://x.com/MengTo via an in-app browser and stored in references/tweet-corpus.jsonl.
Boundary markers: There are no explicit instructions or delimiters provided to the agent to prevent it from obeying instructions that might be embedded within the collected tweet text.
Capability inventory: The skill has broad capabilities including file system access (reading/writing the corpus), shell execution (running Git, Node.js, and Python commands), and network access (browsing X.com).
Sanitization: The ingestion script scripts/update-tweet-corpus.mjs performs structural validation and deduplication but does not sanitize the text content for potential prompt injection payloads.
[DYNAMIC_EXECUTION]: The skill performs dynamic execution of local scripts to maintain its state.
Evidence includes execution of node <skill-dir>/scripts/update-tweet-corpus.mjs to process new data.
It also calls an external script at python3 <skill-creator-dir>/scripts/quick_validate.py, which is located outside the skill's own directory and depends on environment context.

write-like-meng-on-x