The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's agent registration capability allows defining a verification parameter that executes shell commands (e.g., command:grep -q 'Analysis complete' /tmp/analysis.log). This feature enables the execution of arbitrary system commands as part of the task lifecycle.
[EXTERNAL_DOWNLOADS]: The documentation instructs users to install the agent-chief package using pip or uv. This introduces a dependency on an external package not hosted by a predefined trusted organization or well-known service.
[PROMPT_INJECTION]: The skill acts as a bridge between untrusted external data (RSS feeds, HTTP API events, monitoring logs) and an LLM-based 'judge' engine. This configuration is vulnerable to indirect prompt injection, where malicious payloads in the processed events could attempt to manipulate the routing and decision-making logic.
Ingestion points: Data enters the system via the ChiefClient.propose_event method, the resident daemon's local HTTP API endpoint (/v1/events), and various documented integration examples including RSS feeds and CI/CD hooks in SKILL.md.
Boundary markers: No specific boundary markers or 'ignore' instructions are visible in the provided code snippets or referenced Jinja2 prompt templates to separate user data from system instructions.
Capability inventory: The skill possesses capabilities for shell command execution (via the agent verification system), network connectivity (for LLM backends and daemon operations), and file system access (to ~/.chief/).
Sanitization: The skill does not demonstrate explicit sanitization or validation of event content (title, body, metadata) before interpolation into the LLM judge's context.

agent-chief-attention-guard