The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands using the maw utility and standard binaries (mkdir, readlink) to manage local states. User-provided arguments like <oracle-name> and <instruction> are interpolated directly into these shell commands, which presents a risk of command injection if the inputs contain shell metacharacters.
[PROMPT_INJECTION]: The skill includes instructions to override standard safety protocols by explicitly stating "Do NOT ask for confirmation" and "Do NOT enter plan mode." This bypasses human-in-the-loop oversight for the execution of shell commands and the waking of other processes.
[PROMPT_INJECTION]: The skill functions as a relay for user input, passing raw text to other agents via the maw hey command. This creates an indirect prompt injection surface where a malicious instruction could be passed through this skill to exploit the target agent (Oracle). Evidence for this surface in SKILL.md:
Ingestion points: User-provided <instruction> from $ARGUMENTS.
Boundary markers: None; the instruction is placed directly inside a double-quoted string.
Capability inventory: Execution of shell commands via maw wake and maw hey.
Sanitization: No validation or escaping is performed on the instruction before it is passed to the shell or the target agent.

handover