The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands using user-provided input without apparent sanitization.\n
In SKILL.md, the variable ARG is assigned the user's input and then used in a shell subshell: ROOT=$(maw locate "$ARG" --path 2>/dev/null). This pattern is susceptible to command injection if the user provides crafted input containing shell metacharacters.\n- [DYNAMIC_EXECUTION]: The skill implements a mechanism to dynamically load and execute code from external sources.\n
The scripts/soul.ts script uses symlinkSync to link external skill directories into the local project's .claude/skills/ directory. Since the agent platform automatically loads skills from this path, this allows for the execution of arbitrary skill logic defined in any repository the user specifies.\n- [INDIRECT_PROMPT_INJECTION]: The skill consumes unverified content from external repositories that directly influences the agent's behavior.\n
It reads identity-defining files (e.g., SOUL.md, IDENTITY.md, CLAUDE.md) and 'learning' files from the target Oracle repo. These contents are added to the agent's context, providing a vector for instructions embedded in these files to override the agent's persona or instructions.\n- [PERSISTENCE]: The skill automatically modifies the repository's configuration to maintain its presence and avoid detection.\n
It appends paths for the symlinked skills and its own manifest files to .git/info/exclude. This ensures the skill's modifications persist across sessions while remaining hidden from standard git status or git add operations, a technique used to maintain a footprint in a repository without appearing in version control history.

soul