The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from the current session, transcript, or active conversation context to generate a decision log. This creates a surface for indirect prompt injection where an attacker could influence the agent's behavior by embedding instructions in project files, PR bodies, or other artifacts that the agent reads and subsequently logs.
Ingestion points: SKILL.md (Audit the log against the transcript section) specifies reading from the runtime's transcript API or session store.
Boundary markers: None specified for the interpolation of transcript data into the log entries.
Capability inventory: The skill uses scripts/log.sh to write to the filesystem.
Sanitization: The scripts/log.sh file includes a clean() function that strips tabs/newlines and prefixes spreadsheet formula triggers (=, +, -, @) with a single quote. While this protects against CSV injection, it does not sanitize against prompt injection if the log is later read by another agent.
[COMMAND_EXECUTION]: The skill utilizes a shell script (scripts/log.sh) to manage the log file. While the script uses printf and basic sanitization, it is executed via the agent's shell capability.
Evidence: scripts/log.sh uses mkdir -p and printf >> "$logfile" based on arguments passed to it.

show-me-your-work