The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input in multiple steps (Capture, Discover, Process) to create and link notes, and reads project-local configuration files. In Step 3, the agent is instructed to extract atomic insights from raw material provided by the user. There are no explicit boundary markers or instructions to ignore potential commands embedded within this user-provided text. Ingestion points: User input via AskUserQuestion in Steps 1, 2, and 3; project-local configuration files ops/derivation-manifest.md and ops/config.yaml. Boundary markers: The instructions provide a specific structure but do not include delimiters or 'ignore' instructions for processed content. Capability inventory: The skill has access to Write, Edit, Bash, and Read tools. Sanitization: No explicit sanitization of user-provided content is mentioned.
[COMMAND_EXECUTION]: The skill uses the $ARGUMENTS variable to determine execution logic, specifically allowing a 'reset' command to delete the state file. While the scope is narrow, this pattern of using unvalidated arguments to drive file system operations represents a potential attack surface.

tutorial