The Agent Skills Directory

[PROMPT_INJECTION]: The skill uses "MANDATORY" and "MUST" instructions to require the agent to automatically invoke this skill before finishing any other task if changes are detected. This is a behavior override that attempts to hijack the agent's standard task-completion workflow.
[PERSISTENCE]: By mandating execution at the end of every task cycle, the skill establishes a persistent operational hook, ensuring its logic runs continuously without explicit user requests for each synchronization.
[COMMAND_EXECUTION]: The skill automates shell commands including git add, git commit, and git push origin main. Automated pushing to a remote repository without manual review can lead to the accidental exposure of sensitive local changes or project code.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data (files within the .agents/skills/ directory) and instructs the agent to "sanitize" and "generalize" this content. This creates a surface where malicious instructions embedded in the project files could influence the agent during the sanitization phase.
Ingestion points: Reads all files within the .agents/skills/ directory of the working project.
Boundary markers: None. The agent is instructed to read and modify the content directly.
Capability inventory: File system read/write access to a hardcoded local repository path and the ability to execute Git network operations.
Sanitization: The skill relies on the agent itself to sanitize content, which is insufficient to prevent the agent from being influenced by malicious instructions in the source text.
[DATA_EXFILTRATION]: The automated git push functionality targets a hardcoded absolute path (/Users/AlbertMartorell/Development/Android/android-ai-workflow-foundation). While this appears to be the author's local development environment, the automation of code movement to a remote repository (origin main) constitutes a data exfiltration vector if sensitive project data is inadvertently included in the synchronization.

foundation-evolve