The Agent Skills Directory

[COMMAND_EXECUTION]: The SKILL.md file passes the $ARGUMENTS variable directly into a bash command string. This allows for potential command injection if shell metacharacters (such as semicolons, backticks, or pipes) are included in the input provided to the agent.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. 1. Ingestion points: The save command in scripts/manage_note.py accepts unsanitized text via the --content argument. 2. Boundary markers: None are used when displaying notes; content is printed directly into a markdown table. 3. Capability inventory: The skill has Bash execution privileges via the python3 tool. 4. Sanitization: There is no validation or sanitization to ensure that note content does not contain instructions that could hijack the agent's logic.
[COMMAND_EXECUTION]: The Python script scripts/manage_note.py dynamically alters the module search path using sys.path.insert with a computed path based on the file location, which could be exploited to load malicious modules if the directory structure is manipulated.

investment-note