The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill monitors and processes workspace files like SOUL.md and MEMORY.md that can be modified by external entities, creating an attack surface where malicious instructions in these files could influence the agent during drift review.\n
Ingestion points: The guard.py script reads the contents of SOUL.md, AGENTS.md, MEMORY.md, and IDENTITY.md in the cmd_baseline, cmd_check, and cmd_accept functions.\n
Boundary markers: No delimiters or warnings are used to prevent the agent from following instructions embedded in the monitored files when reviewing drift.\n
Capability inventory: The skill has the ability to write to workspace files using the cmd_restore function in guard.py.\n
Sanitization: There is no sanitization or validation of the content read from the monitored files before it is presented to the agent.\n- [CREDENTIALS_UNSAFE]: The skill stores the full, Base64-encoded content of sensitive agent identity files in a local state file, which could contain secrets or private configurations.\n
Evidence: guard.py stores file contents in the baseline_content field of the state object within STATE_FILE.\n- [PERSISTENCE]: The skill uses the platform's native cron scheduling to run periodically, ensuring its logic persists across agent sessions.\n
Evidence: cron: "0 3 * * 0" in the SKILL.md frontmatter.\n- [COMMAND_EXECUTION]: The skill implements its logic via a standalone Python script that the agent is instructed to execute with varying arguments, requiring shell execution capabilities.\n
Evidence: The usage of python3 guard.py for operations like checking drift, restoring files, and adding new files to monitoring.

workspace-integrity-guardian