The Agent Skills Directory

[PROMPT_INJECTION]: The skill establishes an indirect prompt injection surface by instructing agents to ingest and "explicitly apply" instructions labeled as rule_change from local JSON files in the .agent/learnings/ directory. This allows content in project files to override agent behavior without user verification.
[COMMAND_EXECUTION]: The scripts/init-os.sh script modifies the agent's primary instruction files (GEMINI.md and CLAUDE.md) to append a "Startup" routine that persists across sessions and influences future agent behavior.
[PROMPT_INJECTION]: The injected startup routine instructs the agent to "automatically execute" tool calls based on the presence of data in .agent/state/tasks.json. This encourages autonomous behavior triggered by potentially untrusted project data.
[REMOTE_CODE_EXECUTION]: The injected instructions reference an external script path (~/.gemini/skills/heartbeat/scripts/heartbeat.py) that is not included in the skill package, creating an execution dependency on unverified code located in the user's home directory.
[COMMAND_EXECUTION]: The initialization script performs unvalidated file copies from sibling directories using glob patterns (*/templates/eval.json), which could lead to the unintended import of configuration or logic from unrelated or malicious projects in the same workspace.

agentic-os