The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external tool output via the {{last_tool_output}} placeholder to calculate prediction error ('surprise'), creating a vector for indirect prompt injection.
Ingestion points: The {{last_tool_output}} variable is directly interpolated into the System Prompt Template in SKILL.md.
Boundary markers: Absent. The prompt template does not use delimiters or clear boundary instructions to isolate the untrusted tool output from the system instructions.
Capability inventory: The skill explicitly instructs the agent to perform 'Active Inference' (changing the world), which includes editing source code to make it match the agent's predictions.
Sanitization: While the 'Security & Guardrails' section conceptually mentions sanitizing OODA inputs, the provided prompt template lacks implementation of these safeguards.
[DYNAMIC_EXECUTION]: The skill operates within a self-evolution framework described in guides/ai/self-evolving-skills.md that relies on runtime modification of instructions.
Findings: The framework uses an 'Expert Prompt Engineer' LLM to mutate prompts (genes), storing them in a database for later execution. This creates a self-modifying instruction set where the agent's behavior is dynamically determined by previously generated LLM output.
[DATA_EXFILTRATION]: The skill's documentation recommends commands for information gathering that can expose sensitive environmental data.
Findings: The 'Skill Security' section in SKILL.md lists kubectl get as a safe, read-only 'epistemic action'. However, execution of this command can expose sensitive cluster configuration, service names, and resource metadata to the agent's context, which may then be exfiltrated or misused.

active-inference