The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill records user dialogue into session files and later instructs the agent to read these files for clinical review. This creates a surface where malicious instructions provided by the user during the session could be executed by the agent when it re-processes the file content.\n
Ingestion points: The therapy-notes.py script (via add and insight commands) writes user-provided text to session files.\n
Boundary markers: Absent; session notes are stored as plain markdown without delimiters or instructions to ignore embedded commands.\n
Capability inventory: The agent has the ability to read, write, and delete files using the bundled script.\n
Sanitization: Absent; user input is recorded verbatim.\n- [DYNAMIC_EXECUTION]: The bundled therapy-notes.py script is vulnerable to path traversal. The date parameter, provided as a command-line argument and influenced by user interaction, is used to construct file paths (e.g., ACTIVE_DIR / f'session-{date}.md') without sanitization. A crafted input could allow an attacker to read or delete files outside the intended directory.\n- [COMMAND_EXECUTION]: The skill instructs the agent to execute a bundled Python script with arguments derived from user input. While the script uses sys.argv, the lack of validation for these arguments increases the risk of unintended file operations.\n- [DATA_EXPOSURE_EXFILTRATION]: The management script exposes the absolute path of the workspace on the host machine (/Users/sethrose/.clawdbot/workspace/therapy-notes), which reveals information about the host's directory structure and user environment.

therapy-mode