The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from multiple sources to influence its future behavior.
Ingestion points: Reads run logs, error traces, experiment outputs (artifacts/rc-*/), evolve.log, reviews.md, and session files from previous runs.
Boundary markers: The instructions do not define boundary markers or 'ignore' commands for the content being analyzed.
Capability inventory: The skill has the capability to write new instructions (SKILL.md files), modify prompts (prompts.default.yaml), and create knowledge entries.
Sanitization: There is no mention of sanitization or validation of the input data before it is used to generate new agent artifacts.
[DATA_EXFILTRATION]: The skill accesses a wide range of session data and logs (artifacts/rc-*/, evolve.log, session files) which often contain sensitive information such as environment variables, API request/response bodies, or user-provided data. While no network exfiltration was found, the broad access to execution history represents a data exposure surface.
[DYNAMIC_EXECUTION]: The skill dynamically generates executable instructions in the form of SKILL.md files and system prompt patches based on the analysis of external logs. This instruction generation is the core mechanism of the skill but introduces the risk of generating 'evolved' scripts that contain malicious logic if the input data is poisoned.

a-evolve