The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes internal shell scripts (scan-skills.sh and scan-rules.sh) located in its own package directory to inventory the local environment. These commands facilitate the 'Deterministic Collection' phase described in the documentation.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted data from other installed skills.\n
Ingestion points: The skill reads the full text of all files within the agent's skills directory via the scanning scripts.\n
Boundary markers: The sub-agent prompts use structured JSON for output but lack clear delimiters or 'ignore' instructions for the ingested skill content itself.\n
Capability inventory: The skill can read all local skill and rule files and has the capability to modify rule files (subject to user approval).\n
Sanitization: Security relies on a mandatory human-in-the-loop approval process and a requirement that any new principle must be evidenced in at least two separate skills.\n- [SAFE]: The skill follows security best practices by explicitly stating that it will never automatically modify rule files, ensuring the user remains in control of all file system writes.

rules-distill