The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses variables extracted from the pulse-config.yaml file (such as default_branch and repo_path) directly in shell commands including git checkout, git pull, and cd. If the configuration file is sourced from an untrusted location or is maliciously modified, these values could contain shell metacharacters (e.g., ;, &&, |) to execute arbitrary commands on the host system.
[PROMPT_INJECTION]: The strategist agent processes content from untrusted daily research reports (*-daily-research.md) to synthesize a 'theme' and priorities. These synthesized values are then interpolated into shell commands for git commit and gh pr create without sanitization, creating a path for indirect injection attacks.
Ingestion points: Reads all files matching *-daily-research.md in the research directory (Phase 0.4).
Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present when passing data to sub-agents or processing the daily reports.
Capability inventory: The skill has access to the filesystem, shell execution (git, gh, yq), and MCP tools for memory storage (capture_thought, search_thoughts).
Sanitization: The skill lacks validation or escaping for the generated 'theme' or 'priorities' before they are passed to the command line.
[EXTERNAL_DOWNLOADS]: The skill performs git pull operations and interacts with GitHub using the gh CLI to create and merge pull requests. While these operations target a well-known service (GitHub), the specific targets are dynamically determined by the local configuration file.

weekly-strategist