The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and parse OKF bundles, which are external, potentially untrusted collections of Markdown and YAML files. A malicious bundle could contain instructions aimed at subverting the agent's behavior.
Ingestion points: The agent is instructed to read index.md and various concept files (*.md) throughout the bundle directory (SKILL.md, Rules 1 and 3).
Capability inventory: The agent is guided to read files, follow markdown links, dereference URIs (including file:// for local path access), and execute shell commands like grep (SKILL.md, Rules 3, 4, and 5).
Boundary markers: The skill lacks instructions for using delimiters or boundary markers to isolate untrusted bundle content from the agent's core instructions.
Sanitization: There are no requirements for sanitizing or validating the content of the bundle before the agent processes or follows instructions contained within it.
[DYNAMIC_EXECUTION]: Rule 7 in SKILL.md instructs the agent to pass execution receipts to an attester script defined in the bundle's metadata. If the attester resource points to an untrusted local script or a dynamically computed path provided by a malicious bundle, it could lead to arbitrary code execution.
[COMMAND_EXECUTION]: Rule 4 in SKILL.md explicitly directs the agent to execute shell commands (grep or ripgrep) across the bundle directory. This provides a mechanism for a malicious bundle structure to influence shell command parameters or execution context.

okf-reader