The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it is designed to ingest and process data from external, potentially attacker-controlled sources.
Ingestion points: The skill reads data from user-connected accounts including email, calendar, health readers (Apple Health, Health Connect), financial accounts (Plaid), and cloud documents (Google Drive, Docs, Sheets). It also reads from local files like ~/USER.md and ~/MEMORY.md.
Boundary markers: The instructions do not specify the use of clear delimiters or XML-style tags to isolate external content from the agent's instructions, though they do advise the agent to treat data as "evidence rather than ground truth."
Capability inventory: The agent has the ability to update persistent storage using muse.edit to modify ~/MEMORY.md, and uses file tools to write detailed goal state to workspace/goals/<goal-slug>/GOAL.md. It also modifies a goals database via user_goal.create and user_goal.update.
Sanitization: There are no specific instructions for sanitizing or escaping content from external sources before it is stored or processed in later sessions.
[DATA_EXFILTRATION]: The skill is designed to access highly sensitive user data including financial transactions, medical records, and private messages.
The skill explicitly identifies these as sensitive and includes mandatory instructions to seek user permission before accessing such data (e.g., in money.md, health.md, and career.md).
While this is the intended functionality of a goal-tracking assistant, the broad access to sensitive data types creates a risk profile that requires strict adherence to the agent's safety guardrails.

goals