The Agent Skills Directory

[COMMAND_EXECUTION]: The skill framework facilitates the execution of system CLI tools via subprocess.run(). While designed for automation tasks (e.g., using gh or curl), this creates a command execution surface that relies on the permissions.allow configuration in manifest.yml for security enforcement.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. It ingests untrusted data from external sources like HubSpot and CLI outputs, which is then directly interpolated into prompts for the StudioAgent without explicit boundary markers or sanitization logic to prevent malicious data from influencing the agent's behavior.\n
Ingestion points: External data fetched from HubSpot APIs and CLI tools in templates like cs-health-check.py.\n
Boundary markers: Absent in the prompt construction logic.\n
Capability inventory: Shell access via subprocess.run and MCP tool access via StudioAgent.run.\n
Sanitization: Absent; external data is directly interpolated into f-strings for agent prompts.\n- [REMOTE_CODE_EXECUTION]: The CheckpointManager utility uses the Python pickle format (evidenced by .pkl extensions in references/advanced-patterns.md) to save and resume workflow state. Deserializing untrusted pickle files can lead to arbitrary code execution if an attacker manages to modify the checkpoint files on the local filesystem.

graflow