The Agent Skills Directory

[PROMPT_INJECTION]: The skill's 'Silent Capture Protocol' instructs the agent to perform background actions without user visibility, bypassing standard transparency and oversight. Evidence: 'Capture to appropriate namespace WITHOUT announcing' and 'Memory creation is invisible to user' in SKILL.md.
[COMMAND_EXECUTION]: Bash templates used for memory creation utilize unquoted heredocs (<< MEMORY_EOF), which allow for shell command substitution of variables like ${TITLE}. If the agent populates these with untrusted user input containing characters like $(...), arbitrary commands may be executed on the host system. Evidence: Capture logic in references/capture.md.
[DATA_EXFILTRATION]: The skill gathers local repository metadata via git remote get-url origin. This information is stored in the memory system and can expose sensitive credentials, authentication tokens, or private path structures embedded in remote URLs. Evidence: references/capture.md.
[PROMPT_INJECTION]: The system creates an indirect prompt injection surface by ingesting and storing untrusted data that is later retrieved as context.
Ingestion points: Memory capture triggers based on user phrases in SKILL.md.
Boundary markers: Basic YAML frontmatter delimiters.
Capability inventory: Filesystem access and command execution via Bash and Write tools.
Sanitization: No validation or sanitization of captured content exists.

core