The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill determines file paths and line ranges from the interaction context and interpolates them directly into a Lisp expression executed via emacsclient. If the context contains specially crafted strings (e.g., paths containing escaped quotes and Lisp commands), it could lead to unauthorized command execution within the user's Emacs session.
Ingestion points: File paths and region parameters are extracted from the "most recent interaction context" as described in SKILL.md.
Boundary markers: The instructions provide a template for the command but do not specify delimiters or warnings for the agent to ignore instructions embedded within the data it is processing.
Capability inventory: The skill uses the Bash tool to run emacsclient --eval, which can execute arbitrary Emacs Lisp code, including file operations and subprocess spawning.
Sanitization: There is no requirement or logic provided to escape or validate the interpolated values before they are passed to the shell.
[COMMAND_EXECUTION]: The skill relies on emacsclient --eval to perform its primary function. While this is expected behavior for an Emacs integration, it represents a high-privilege capability that can be abused if the agent is manipulated by external data inputs.

highlight