The Agent Skills Directory

[COMMAND_EXECUTION]: The bash command zai chat $ARGUMENTS interpolates user-supplied data into a shell string without quoting or validation. This allows an attacker or user to execute arbitrary commands by including shell metacharacters (e.g., semicolons, pipes, or backticks) in the input.
[INDIRECT_PROMPT_INJECTION]: The skill processes output from an external AI model (GLM-5.2) and explicitly instructs the agent to 'fix' the skill's own definition based on that output.
Ingestion points: Output from the zai CLI tool.
Boundary markers: Absent; there is no separation between the instruction block and the data returned from the external model.
Capability inventory: Access to the Bash tool and file system write access to SKILL.md.
Sanitization: Absent; no filtering is applied to the external output before it influences the modification of the skill's logic.
[PERSISTENCE]: The 'Self-Evolving Skill' section establishes a dangerous feedback loop where runtime behavior and external model output can persistently alter the agent's core instructions. This mechanism could be exploited to maintain unauthorized changes to the agent's behavior across sessions.

glm