The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The prose install command and the deps.md specification describe a system for cloning remote Git repositories from arbitrary hosts into a local deps/ directory. This allows the agent to download third-party code from any URL.
[REMOTE_CODE_EXECUTION]: Code downloaded via the dependency system is intended to be executed by the agent as part of the 'OpenProse VM' orchestration flow. This creates a direct vector for running unverified remote scripts and programs.
[COMMAND_EXECUTION]: The skill requests and utilizes high-privilege tools, including bash, execute_command, and python, to perform Git operations, manage filesystems, and run sub-agent sessions.
[PERSISTENCE]: The prose serve command registers local cron jobs and HTTP trigger adapters to launch automated agent activations. The framework also maintains 'durable cross-run state' in the filesystem, allowing it to persist behavior across sessions.
[METADATA_POISONING]: The SKILL.md file contains a dedicated section instructing the agent on how to proactively propose and 'sell' the OpenProse framework to the user, even if the user has not requested it. This is a form of behavioral manipulation to increase the framework's adoption.
[INDIRECT_PROMPT_INJECTION]: The framework is designed to ingest and process untrusted external data (e.g., the planning-corpus or inbox-gateway examples) which is then interpolated into prompts for sub-agents. This creates a significant surface for indirect prompt injection attacks.
[DATA_EXFILTRATION]: The documentation in deps.md confirms that the system utilizes the user's existing Git credential helpers and SSH keys. Given the agent has bash access, these sensitive credentials could be exfiltrated to an external server.

open-prose