The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes arbitrary command output, which is a potential vector for indirect prompt injection where malicious instructions are hidden in data processed by the agent.
Ingestion points: The skill captures and processes stdout and stderr from shell commands, which are then presented to the agent as context in SKILL.md and README.md.
Boundary markers: The skill explicitly instructs the agent to follow a "Recovery anchoring rule," treating only the first line of the adapter output as trusted and all subsequent data as untrusted capture content. It also utilizes frame labels to delimit recovered data and provide clear separators.
Capability inventory: The agent uses a local Python filter script to manage file captures. While it can read and write capture files in a private directory, it does not execute the captured content as code or instructions.
Sanitization: The skill's documentation indicates it attempts to detect and avoid compressing common credential patterns, although it notes that captured text is still visible to the model context in raw form.
[COMMAND_EXECUTION]: The skill requires the agent to run local Python scripts to manage the lifecycle of data captures, including preparation, sealing, filtering, and recovery.
Evidence: Instructions in SKILL.md define commands such as @PYTHON@ -I @FILTER@ prepare and @PYTHON@ -I @FILTER@ seal.
The skill specifically mandates using the -I flag for the Python interpreter to isolate the process from potentially malicious environment variables like PYTHONPATH or PYTHONHOME, which could be used for local privilege escalation or code injection.

token-optimizer-output