The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process potentially untrusted data from external sources including issue descriptions, review text, and tool outputs.
Ingestion points: Identified in SKILL.md as fetched content, review text, issue text, and command output.
Boundary markers: The instructions explicitly direct the agent to treat such content as data rather than instructions to mitigate the risk of the agent obeying embedded commands.
Capability inventory: The agent possesses authority for local filesystem writes, remote repository operations (such as creating Pull Requests via shipit), and interaction with a local CLI tool.
Sanitization: The skill relies on behavioral instructions for the AI to separate data from instructions rather than implementing explicit programmatic sanitization or escaping.
[DYNAMIC_EXECUTION]: The system dynamically identifies and loads specialized instruction files (SKILL.md) from the local filesystem at runtime based on a step registry.
Evidence: references/commands.md and references/loops.md define a registry of relative paths (e.g., ../kata-understand/SKILL.md) used for logic loading.
Mitigation: The skill includes explicit security instructions to prevent path traversal, such as verifying that resolved paths remain within the intended directory and strictly forbidding the construction of paths from user-provided data.
[COMMAND_EXECUTION]: The skill incorporates an optional runtime client that interacts with local shell commands (jido or jidoka) to inspect system state.
Security measures: The instructions in references/runtime-client.md require absolute path resolution and source verification of the executable to prevent command hijacking or the execution of unauthorized binaries. It also mandates that the output of these commands be treated as untrusted data.

jido