The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute a Python script using direct string interpolation of a potentially untrusted variable. \n
Evidence: The instruction to run python {skill_path}/scripts/session_manager.py --update {session-id} --state running includes the {session-id} variable, which is derived from user input or session configuration. If not sanitized, a malicious session ID could be used to execute arbitrary shell commands via the agent's shell tool.\n- [INDIRECT_PROMPT_INJECTION]: The skill orchestrates subagents by interpolating task descriptions and session configuration data into their system prompts without appropriate security boundaries.\n
Ingestion points: The skill reads configuration data from .agenthub/sessions/{session-id}/config.yaml and processes a user-provided task description (SKILL.md).\n
Boundary markers: Absent. There are no delimiters, escaping mechanisms, or instructions for the subagents to ignore potentially malicious commands embedded within the interpolated task or configuration data.\n
Capability inventory: Subagents are granted significant capabilities, including modifying the filesystem, running tests, and committing code changes (SKILL.md).\n
Sanitization: Absent. The skill does not provide instructions for validating or filtering the task or configuration data before it is passed into the subagent's execution context.\n- [DYNAMIC_EXECUTION]: The skill dynamically generates and executes prompts for subagents based on provided templates at runtime.\n
Evidence: The skill uses predefined templates (e.g., optimizer, refactorer) to construct and launch new agent instances via the Agent() tool, which involves dynamic construction of the agent's operating context.

spawn