The Agent Skills Directory

[COMMAND_EXECUTION]: Potential Shell Command Injection. The skill instructs the agent to execute shell commands using templates like maw hey {MAW or agent-oracle} '{preview}' and echo "$MESSAGE" > "$INBOX/...". If the {preview}, {MAW}, or {agent} variables contain unescaped single quotes or other shell metacharacters, an attacker could execute arbitrary commands on the host system. For example, a message preview containing a closing single quote followed by a command (e.g., '; touch /tmp/pwned; ') would result in the execution of the injected command.
[PROMPT_INJECTION]: Indirect Prompt Injection Surface. The 'loop' functionality (Mode 4) creates an autonomous loop where the agent reads responses from other agents and uses that content to decide its next action.
Ingestion points: Data is ingested from external agents via arra_thread_read({ threadId }) within the autonomous loop described in SKILL.md.
Boundary markers: There are no boundary markers or instructions to treat the incoming message content as untrusted data, making the agent susceptible to instructions embedded in responses from other agents.
Capability inventory: The skill possesses significant capabilities including shell command execution (maw), filesystem write access (ψ/inbox/), and the ability to create/post to messaging threads (arra_thread).
Sanitization: No sanitization, filtering, or validation is performed on the content received from the arra_thread_read tool before it is processed by the agent's logic.

talk-to