The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon external instructions from a remote or local 'board'.
Ingestion points: The agent is instructed to wait for and process 'notes' (note.added) and 'ratified plans' (plan.ratified) from the Helix Arena board.
Capability inventory: The skill has access to the Bash and PowerShell tools to execute the helix binary, write to local directories in ~/.helix, and perform network operations via curl to a local API.
Boundary markers: The instructions do not specify boundary markers or validation for the 'notes' provided by the board.
Sanitization: No explicit sanitization of the content from the board is mentioned before the agent is told to 'act on it'.
[DATA_EXFILTRATION]: The skill's auditing mechanism supports processing files via absolute paths, which could be used to expose sensitive local data.
Evidence: The audit event payload documentation specifies kind:"screenshot"|"image" with a path parameter that requires an 'absolute path'.
Risk: If an untrusted candidate or a malicious instruction provides an absolute path to a sensitive file (e.g., ~/.ssh/id_rsa or .env), the system may attempt to capture or display it on the 'board'.
[COMMAND_EXECUTION]: The skill utilizes shell command substitution derived from the contents of local configuration files, which can be a vector for command injection.
Evidence: The 'Server operations' section provides a command to kill the server: kill "$(sed -n 's/.*"pid": *$[0-9]*$.*/\1/p' ~/.helix/arena/<project>/<slug>/server.json)".
Evidence: The 'Waiting on the board' section extracts a port: PORT=$(sed -n 's/.*"port": *$[0-9]*$.*/\1/p' .../server.json) then runs curl -s "http://127.0.0.1:$PORT/api/state".
Risk: While the files are located in the user's home directory (~/.helix), any process capable of writing to these files could achieve local command execution when the agent runs these administrative commands.

arena