The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill reads from and writes to a TODO.md file containing task descriptions provided by the user.
Ingestion points: Task content is ingested through the "Add Item" instructions in SKILL.md and stored in the workspace TODO.md file.
Boundary markers: The agent reads the file using cat TODO.md without specific delimiters or instructions to ignore embedded commands within the tasks.
Capability inventory: The skill possesses file read/write capabilities and executes local shell scripts.
Sanitization: There is no evidence of sanitization or filtering of task content to prevent instructions within a task from influencing the agent's behavior during a list summary.
[COMMAND_EXECUTION]: The scripts/todo.sh bash script interpolates user-supplied strings directly into shell commands.
Evidence: The script uses variables like $pattern inside sed and grep commands: sed -i "/\- \[ \].*$pattern/d" "$TODO_FILE".
Risk: While the impact is limited to the local TODO.md file, task names containing special characters (such as / or regex control characters) could cause the script to malfunction or modify unintended lines within the TODO list.

todo-tracker