The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill documentation describes commands that allow an agent to ingest untrusted data from external Astrale Kernels, which could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: Data enters the agent's context through astrale logs (reading kernel journals), astrale get / astrale query (reading graph nodes), and astrale introspect (reading domain schemas).
Boundary markers: The instructions do not specify any delimiters or safety guidelines to prevent the agent from executing instructions embedded within the data returned by these commands.
Capability inventory: The CLI tool possesses significant capabilities, including performing network mutations (astrale mutate), making remote procedure calls (astrale call), generating local source code (astrale ui init), and issuing authentication tokens (astrale token).
Sanitization: There is no evidence of sanitization or filtering of external content before it is processed or presented to the agent.
[DATA_EXPOSURE]: The skill explicitly documents the sensitive directory structure where the CLI stores credentials and session data, facilitating potential exfiltration if the agent is compromised.
Evidence: The "Storage" section lists sensitive paths under ~/.astrale, including keys/ (private keys), idp-sessions/ (upstream identity provider tokens), and config.json.
[EXTERNAL_DOWNLOADS]: The CLI is designed to download and install executable code or configuration from remote sources at runtime.
Evidence: The astrale ui add command fetches patterns and themes from a remote registry based on a commit snapshot. The astrale domain install command allows installing domain logic directly from an external URL.

astrale-cli