The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill has a vulnerability surface where data read from the local environment (the knowledge vault) influences shell commands and prompt generation.
Ingestion points: The skill reads several user-controlled files including ops/derivation-manifest.md, ops/derivation.md, ops/queue/queue.yaml, and the content of various markdown notes to determine the system state.
Boundary markers: No explicit delimiters or instructions are used to prevent the agent from interpreting instructions embedded within the metadata or note content.
Capability inventory: The skill uses Bash to execute file listing and counting commands, and Read/Grep/Glob to inspect the file system.
Sanitization: There is no evidence of validation or sanitization for values extracted from derivation-manifest.md before they are used as directory names in shell commands (e.g., in the ls commands defined in Step 1).
[COMMAND_EXECUTION]: The skill uses the Bash tool to perform state analysis and gather metrics about the vault.
Evidence: The skill defines shell scripts in SKILL.md (Step 1) that utilize ls, wc, and tr to calculate file counts. While the commands themselves are intended for gathering metrics, the paths used are dynamic and dependent on the vault's configuration files.

help