The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads and installs a CLI tool from a third-party GitHub repository (github.com/tylerwince/grizzly) using the 'go install' command during the setup phase. This dependency is retrieved from an unversioned (@latest) source.
[CREDENTIALS_UNSAFE]: The skill manages a Bear API authentication token stored locally at '~/.config/grizzly/token'. While it follows the safe practice of using local configuration files for secret management rather than hardcoding credentials, the agent has the capability to read this sensitive file.
[COMMAND_EXECUTION]: The skill frequently executes shell commands via the 'grizzly' binary to perform note operations such as creation, searching, and reading. These commands are necessary for the skill's primary function but involve the execution of a locally installed third-party binary.
[PROMPT_INJECTION]: The skill is subject to an indirect prompt injection attack surface as it reads and processes data from external sources (Bear notes).
Ingestion points: User-defined note content is ingested into the agent context through the 'grizzly open-note' and 'grizzly tags' commands as documented in SKILL.md.
Boundary markers: Absent. There are no instructions or delimiters provided to ensure the agent ignores or treats embedded instructions within the notes as data rather than commands.
Capability inventory: The skill provides the agent with the ability to execute shell commands to modify notes, list tags, and interact with the local file system (e.g., writing to config files).
Sanitization: Absent. The skill does not perform any validation or sanitization of the content retrieved from Bear before it is processed by the agent.

bear-notes