The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/ask.py uses subprocess.run to execute the claude CLI. It facilitates a web-based question box that allows the agent to execute tools such as Bash, Read, Glob, and Grep in a headless mode (--permission-mode dontAsk). The instructions also describe how to override security settings using JOURNEY_ASK_PERMISSION_MODE=bypassPermissions to allow automated tool execution without user confirmation.- [DYNAMIC_EXECUTION]: The SKILL.md file instructs the agent to generate and execute Python code dynamically via stdin (`python3
<<'PY'`) to perform complex SQL queries against the local analytics database. This pattern is used to handle follow-up questions that require judgment beyond the static report.- [INDIRECT_PROMPT_INJECTION]: The skill ingests potentially untrusted data from a local 'lake' of analytics events (including URL paths and page titles) and user-supplied text from a web interface. The absence of explicit boundary markers for data interpolation presents a vulnerability surface for indirect prompt injection.
Ingestion points: Parquet data files processed by scripts/journey.py and API POST requests in scripts/serve.py (via scripts/ask.py).
Boundary markers: None identified in the prompt instructions or script logic for the interpolation of data from the analytics lake.
Capability inventory: The agent is granted Bash, Read, Glob, Grep, Skill, Task, and TodoWrite capabilities for answering follow-up questions.
Sanitization: The engine uses DuckDB parameterization for some queries, but the bridge in ask.py only performs basic string stripping on user-supplied questions.

journey-report