The Agent Skills Directory

[COMMAND_EXECUTION]: The skill interpolates user-supplied input (<topic> and <sender>) directly into shell commands via echo "<topic>". This creates a risk of command injection if the input contains shell metacharacters like semicolons, backticks, or command substitution syntax (e.g., $(...)), as these would be executed before the intended sanitization steps (tr and sed) are applied.
[PROMPT_INJECTION]: The skill retrieves and displays content from markdown files stored in the inbox, introducing an indirect prompt injection vulnerability where malicious instructions within a note could influence agent behavior.
Ingestion points: Content is ingested from .md files located in the ψ/inbox/ directory during read operations in SKILL.md.
Boundary markers: No explicit delimiters or guardrail instructions are used to distinguish retrieved note content from the agent's system instructions.
Capability inventory: The skill allows for file system operations including listing, moving, and archiving files, as well as invoking MCP tools like oracle_inbox and oracle_handoff.
Sanitization: While filenames are sanitized to prevent path traversal, the actual content of the markdown files is not sanitized or validated before being returned to the agent context.

inbox