The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill instructs the agent to construct an Emacs Lisp expression and execute it via emacsclient --eval. This involves interpolating file paths and line numbers directly into the Lisp code. If these inputs contain special characters like double quotes or parentheses, it could lead to Lisp injection, allowing arbitrary code execution within the Emacs process.
[INDIRECT_PROMPT_INJECTION]: The skill operates on data from the "latest interaction," which is an untrusted ingestion point. If an attacker can influence the conversation, they could provide malicious "file paths" designed to trigger the injection vulnerability or trick the agent into opening sensitive local files. 1. Ingestion points: Conversation history, specifically file paths and line numbers mentioned in the latest interaction in SKILL.md. 2. Boundary markers (absent): No delimiters or warnings are used to handle untrusted file paths. 3. Capability inventory: Execution of Bash commands to run emacsclient --eval which executes arbitrary Lisp as described in SKILL.md. 4. Sanitization (absent): No escaping or validation of external file paths is instructed before interpolation into the Lisp string.
[COMMAND_EXECUTION]: The skill uses the Bash tool to execute host-level commands (emacsclient), providing a pathway for interaction with the local system environment.

open