The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/audit.py script utilizes subprocess.run(shell=True) to execute system commands for directory auditing. Specifically, in the skills_inventory, workspace_structure, and recent_records functions, command strings are constructed using f-strings that incorporate directory names directly from the filesystem (e.g., f"find '{skill_dir}' -type f | wc -l"). While the variables are wrapped in single quotes, a directory name containing a single quote followed by shell metacharacters (e.g., dir'; [malicious_command] #) could result in arbitrary command execution when the audit is performed.
[INDIRECT_PROMPT_INJECTION]: The skill's reflection loop (Phases 2, 3, and 5) ingests external, potentially untrusted data to inform its 'Action Plan'.
Ingestion points: Metadata (name and description) from SKILL.md files of all installed skills in scripts/audit.py, and search results from the supermemory skill (e.g., user preferences, limitations, and past decisions).
Boundary markers: The instructions do not define boundary markers or 'ignore' instructions for the data being reviewed during the Skills Review or Capability Gap Analysis phases.
Capability inventory: The skill has the ability to execute shell commands via audit.py, send SMS notifications via send_sms_to_user, and write files to the Records/Reflections/ directory.
Sanitization: There is no evidence of sanitization or escaping of the ingested skill metadata or memory content before it is processed by the AI. An attacker could potentially influence the AI's self-improvement actions by placing malicious instructions in a skill's description or in the memory graph.

self-improvement