The Agent Skills Directory

[COMMAND_EXECUTION]: The skill dynamically generates shell commands using file paths and configuration values. Specifically, the instructions for opening browsers use nohup "<command>" <args...> "<file://absolute-path>". The use of unquoted <args...> provides a vector for argument injection or arbitrary command execution if the configuration file or the environment contains malicious entries.
[DYNAMIC_EXECUTION]: Executable paths and runtime arguments are retrieved from config.json files located in the project root or the user's home directory (~/.agents/.skills-config/open/config.json). This mechanism allows for the runtime modification of the commands executed by the agent, which could be exploited if an attacker can manipulate these configuration files.
[INDIRECT_PROMPT_INJECTION]: The skill processes file and folder paths as input from the local environment. This creates an attack surface where a maliciously crafted filename (e.g., containing shell metacharacters) could attempt to influence the generated command line.
Ingestion points: File/folder paths passed to the Bash tool.
Boundary markers: Absent; the instructions rely on the LLM to properly quote variables.
Capability inventory: Uses Bash for command execution (open, grip, nohup, pgrep, curl).
Sanitization: None specified beyond resolving paths to absolute locations.
[EXTERNAL_DOWNLOADS]: The skill utilizes the grip tool to render Markdown content, which operates by sending the content to the GitHub API. This results in the transmission of local file data to a third-party service. While GitHub is a well-known service, this behavior constitutes an external data transit that users should be aware of.

open