The Agent Skills Directory

[PROMPT_INJECTION]: The SKILL.md file contains instructions for the agent to load and apply overrides from a local directory (~/.opencode/skills/CORE/USER/SKILLCUSTOMIZATIONS/AnnualReports/) using files like PREFERENCES.md. This mechanism allows unverified local files to persistently override agent behavior.
[EXTERNAL_DOWNLOADS]: The skill performs network requests to fetch data from external sources: Tools/UpdateSources.ts fetches from a public repository on GitHub, and Tools/FetchReport.ts fetches from arbitrary URLs. This capability could be exploited for Server-Side Request Forgery (SSRF) against internal network resources if malicious URLs are provided.
[PROMPT_INJECTION]: The skill exhibits a significant attack surface for indirect prompt injection. Ingestion points: Tools/FetchReport.ts downloads external HTML/Text and Tools/UpdateSources.ts downloads a remote README file. Boundary markers: No markers or explicit instructions are provided to the agent to distinguish fetched report content from core system instructions. Capability inventory: The agent is tasked with analyzing the downloaded content, and the skill possesses file-write capabilities (writeFileSync in Tools/FetchReport.ts and Tools/UpdateSources.ts). Sanitization: While Tools/FetchReport.ts strips HTML tags, it does not filter for natural language instructions designed to subvert the LLM.

AnnualReports