The Agent Skills Directory

PROMPT_INJECTION (HIGH): Vulnerable to Indirect Prompt Injection through untrusted human/bot feedback.
Ingestion points: The skill reads markdown files from ~/.arbiter/queue/ using readFileSync and readdirSync in src/utils.ts. These files are populated by an external review bot.
Boundary markers: There are no boundary markers or instructions to the agent to ignore embedded commands within the 'answer' fields parsed from markdown.
Capability inventory: The agent uses results from arbiter_get to make architectural decisions, approve plans, and proceed with potentially high-privilege tasks. Malicious input in the decision queue could hijack this logic.
Sanitization: Absent. src/utils.ts uses basic regex (/^answer:\s*(.+)$/m) to extract values, which does not prevent command or prompt injection.
COMMAND_EXECUTION (MEDIUM): Path Traversal in decision plan creation.
Evidence: In src/push.ts, the agent variable is incorporated directly into a filename and joined to a path using path.join without sanitization. An attacker controlling the agent parameter (via injection in a previous agent step) could use values like ../../ to write files to arbitrary locations.
Impact: While file extensions are limited to .md, this allows unauthorized file creation in sensitive directories (e.g., ~/.ssh/config.md or ~/.bashrc.md).

arbiter