The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructions use highly directive language (e.g., "This skill is mandatory", "MUST begin", "No exceptions") to override standard agent autonomy and enforce a strict operational sequence.
[COMMAND_EXECUTION]: The skill defines several tools that execute shell commands using environment variables ($MCP_CALL and $GAIT_MCP_SCRIPT) to invoke its backend Python-based MCP server. This relies on the security and integrity of the execution environment provided by the platform.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and stores potentially untrusted content from the user and the assistant via the gait_record_turn tool. This content is later displayed using gait_log or gait_show, which could lead the agent to execute hidden instructions contained within historical logs.
Ingestion points: Parameters user_text and assistant_text in the gait_record_turn tool call.
Boundary markers: None are defined in the instructions for how the agent should interpret or display the retrieved log content.
Capability inventory: The skill has the capability to execute shell commands via the configured MCP wrapper.
Sanitization: There is no evidence of programmatic sanitization or escaping of the text stored in the audit logs; the documentation only suggests sanitizing artifact references manually.

gait-session-tracking