The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructions attempt to suppress standard agent safety behaviors. In SKILL.md, the directives "Don't ask the developer for confirmation before writing" and "Don't echo or paraphrase the helper's output" are direct attempts to override safety protocols requiring user consent and oversight for system changes.
[COMMAND_EXECUTION]: The skill executes a local Python script via the shell to modify the filesystem. When combined with the instruction to bypass user review, this constitutes autonomous command execution and file modification, which increases the risk of unauthorized system changes if input parameters are manipulated.
[INDIRECT_PROMPT_INJECTION]: The skill presents a vulnerability surface for data poisoning because it writes unvalidated input to persistent files.
Ingestion points: Data provided to command-line arguments (e.g., --slug, --principal) and the body text provided via stdin in scripts/register.py are ingested from the agent's context.
Boundary markers: No boundary markers or instructions to ignore embedded commands are used when writing the data to markdown files.
Capability inventory: The register.py script has capabilities to create directories and write files both within the repository (docs/debt/) and in the user's home directory (~/.cache/debt-ops/).
Sanitization: Input data is not sanitized or escaped before being written into markdown files. If these files are later read by an agent, they could contain malicious instructions designed to trigger unintended tool calls.

debt-ops-add