The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses Bash to execute shell commands (e.g., python3, cat) with arguments like $TARGET, $AUTHOR, and $JURY_THREAD_ID derived from an external manifest.jsonl file. Without explicit sanitization of these variables before interpolation into shell commands, an attacker who compromises the producer skill could achieve arbitrary command execution during the landing process.\n- [INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to malicious instructions embedded in staged patches. 1. Ingestion points: staged .diff files and the manifest.jsonl in the .aris/meta/pending/ directory. 2. Boundary markers: The skill uses fresh codex threads and 'paths-only' context for the review jury, but lacks explicit data delimiters or "ignore instructions" headers. 3. Capability inventory: The skill has the power to Write and Edit the skill corpus and execute Bash commands. 4. Sanitization: There is no evidence of filtering or escaping patch content before review.\n- [DYNAMIC_EXECUTION]: The skill resolves the provenance.py utility through a multi-layer search chain involving relative paths (.aris/tools/) and user-specific directories (~/.aris/repo). This dynamic path resolution introduces a risk of script hijacking if an attacker gains write access to any of the searched locations.\n- [PRIVILEGE_ESCALATION]: The skill is explicitly designed to perform self-modification of the agent's corpus, intentionally bypassing standard write protections like corpus_write_guard. While it incorporates verification steps, a failure in the jury logic or the human-in-the-loop review could lead to the landing of unauthorized code that permanently alters the agent's behavior.

meta-apply