The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill operates by discovering 'tribal knowledge' from the entire repository, including unvetted sources like git history, TODO/FIXME comments, and discussion logs. This data is used to populate prompts for authoring new skills, creating a surface for embedded malicious instructions to influence the agent.
Ingestion points: Local file system (README, manifests, build configs, CI files, git history, TODO/FIXME hotspots, discussions, ADRs, and journals) as described in SKILL.md under Phase 1: Discover.
Boundary markers: No specific delimiters or warnings are used to isolate ingested data from instructions in the generated prompts for the authoring agents.
Capability inventory: Extensive file system read access; local file system write (restricted by a 'write fence' to .claude/skills/ and .attune/mission-state.json); local command execution for verification and build system analysis.
Sanitization: The instructions do not define any sanitization, escaping, or filtering of repository content before it is interpolated into prompts.
[DYNAMIC_EXECUTION]: The workflow involves generating new SKILL.md files that contain 'provenance and maintenance' commands, which are subsequently executed during the review phase to verify claims.
Evidence: modules/review-protocol.md requires the FACTUAL lens reviewer to "run each skill's provenance one-liners."
[COMMAND_EXECUTION]: The skill requires the agent to execute shell commands to investigate the repository's build system and run maintenance checks.
Evidence: SKILL.md includes maintenance commands like rg -c "Phase" ... and ls .claude/skills/ | head -5, and instructions to verify how tests actually run during Phase 1.

skill-library-mission