The Agent Skills Directory

[COMMAND_EXECUTION]: The "Vault Discovery" and "Bootstrap" workflows in references/mapping.md instruct the agent to execute shell commands to set up the workspace. This includes using mkdir -p to create directories, ln -s to create symbolic links, and printf to write data to configuration files. It also includes instructions to use git rev-parse --show-toplevel and modify .git/info/exclude.
[DATA_EXFILTRATION]: The skill is instructed to read from and write to ~/.config/wrap-up/vault in the user's home directory. Accessing and modifying configuration files outside the project's local directory constitutes a data exposure risk, as the agent is interacting with the host system's global configuration.
[PROMPT_INJECTION]: The references/transcription.md file defines a workflow that ingests untrusted transcription content and directs the agent to derive "Observations" and "Tags" from it. This establishes an indirect prompt injection surface.
Ingestion points: Untrusted transcription text provided by the user in references/transcription.md.
Boundary markers: Absent; the content is placed directly into a markdown template without delimiters or instructions to ignore embedded commands.
Capability inventory: The agent has access to write_note, patch_note, and read_note tools via the MCPVault MCP server, as well as shell command execution capabilities defined in mapping instructions.
Sanitization: Absent; the instructions explicitly state to "preserve exactly as provided" and to generate observations by reading the content.

notes