The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructions mandate acquiring AO or SO product packages from the NuGet global-packages cache or downloading them directly if not present. These are self-contained runtime binaries that the agent is then instructed to invoke directly with shell commands.
Evidence: Instructions in reference/runtime-dependency.md describe downloading from NuGet, verifying SHA-512 hashes against metadata, and executing the 'apphost' entry point.
[COMMAND_EXECUTION]: The skill uses subprocess calls to execute binary commands (ao ask start, so ask result, ao --guide). These commands are used to initiate user sessions and retrieve results.
Evidence: SKILL.md and reference/runtime-dependency.md provide specific command lines for starting and querying the ask service.
[DATA_EXPOSURE]: The skill writes a 'complete versioned contract' to a local disk file before passing its path to the binary. This file may contain sensitive question data or metadata that remains on the file system.
Evidence: SKILL.md Step 5: 'Write the complete versioned contract to a disk file, then start it with ao ask start --contract-file <path>'.
[INDIRECT_PROMPT_INJECTION]: The skill acts as a bridge for user-provided data, creating a vulnerability surface where malicious input from the user (answers) could influence the behavior of the calling agent.
Ingestion points: User answers collected via the XO Ask browser interface (SKILL.md, reference/answer-semantics.md).
Boundary markers: The documentation mentions a 'shared server validator' as authoritative, which acts as a validation boundary.
Capability inventory: The skill can execute local binaries via subprocess and write to the local file system (SKILL.md).
Sanitization: The skill relies on the binary's internal validation; there is no explicit instruction for the agent to sanitize the results before returning them to the caller.

loom-ask-user