The Agent Skills Directory

[PROMPT_INJECTION]: The skill documents defensive measures against prompt injection attacks. Several files (e.g., SKILL.md, SECURITY.md, template/CLAUDE.md) contain strings often associated with prompt injection, such as 'ignore previous instructions' and 'you are now X', but these are used as examples of content to be ignored or reported as data rather than instructions to be followed.\n- [PROMPT_INJECTION]: The skill processes untrusted third-party documents in the vault/ directory, which represents a surface for indirect prompt injection (Category 8).\n
Ingestion points: Documents are ingested via scripts/local_ingest.py and stored in vault/.\n
Boundary markers: Extractions are wrapped in BEGIN/END FETCHED CONTENT markers and tagged with untrusted: true in YAML frontmatter.\n
Capability inventory: The agent can commit changes to the wiki/ directory using git, execute local scripts via uv run, and perform queries on SQLite and Kuzu databases.\n
Sanitization: scripts/scrub_check.py is used as a mandatory gate to scan content for injection patterns before commits or indexing.\n- [DATA_EXFILTRATION]: The scripts/identifier_resolve.py script can send chemical names or gene symbols to public databases (PubChem and MyGene.info) for resolution. This feature is off by default, requires explicit user opt-in in config.json, and follows a two-step 'review then run' process to ensure user oversight.\n- [EXTERNAL_DOWNLOADS]: The scripts/update.sh script facilitates skill updates from GitHub. The update source defaults to the author's upstream repository to prevent redirection attacks, and non-default sources trigger a prominent warning during the preview stage.

curiosity-engine