The Agent Skills Directory

[PROMPT_INJECTION]: The documented 'ReadTool' in references/tool-module.md automatically resolves and injects instructions from AGENTS.md files located in parent directories of files being read. This design feature creates a surface for indirect prompt injection, where an attacker-controlled repository could influence agent behavior through hidden instruction files.
Ingestion points: InstructionPrompt.resolve triggered automatically when reading files.
Capability inventory: Access to BashTool, ReadTool, WriteTool, and TaskTool for codebase manipulation.
Boundary markers: Instructions are resolved per-messageID to limit scope, but no explicit sanitization of embedded instructions is described.
[COMMAND_EXECUTION]: The skill documents the architecture and use of powerful shell and filesystem tools for codebase manipulation.
references/helpers-deep-dive.md describes the Archive.extractZip utility which executes PowerShell commands (Expand-Archive) on Windows and unzip on Unix-like systems.
references/architecture.md and references/tool-module.md describe the BashTool, which provides the agent with the ability to execute arbitrary shell commands in the project environment.
references/helpers-deep-dive.md describes a Process utility using cross-spawn to launch child processes with support for piping and custom environment variables.
[DATA_EXFILTRATION]: The architecture includes documentation for tools that can access sensitive data and perform network operations.
references/tool-module.md describes the ReadTool logic for identifying and requesting permission to read sensitive .env files.
references/architecture.md lists WebFetchTool and WebSearchTool alongside filesystem tools, providing a potential path for data exfiltration if the agent's logic is subverted through indirect injection.

opencode-ts