The Agent Skills Directory

[PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection via its message retrieval functionality.
Ingestion points: The maw peek command (in SKILL.md) retrieves message content from external nodes in the federation and displays it to the agent.
Boundary markers: No delimiters or instructions are used to separate external message content from the agent's primary instructions.
Capability inventory: The skill environment permits shell command execution (including maw, git, grep, and hostname).
Sanitization: No filtering or escaping is applied to the incoming message content before it is processed by the agent.
[COMMAND_EXECUTION]: The skill relies on shell command execution for its primary operations and metadata gathering.
The 'Step 0' logic executes several system and repository commands (hostname, git rev-parse, grep, sed) to resolve the agent's handle and host identity.
The send and peek operations utilize the maw command-line interface. While variables like $MSG and $TARGET are quoted in the provided shell snippets, the reliance on shell execution to handle remote message data increases the overall attack surface.

hey