The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements a mechanism to inject external data into the AI's system prompt without adequate sanitization or boundary enforcement.
Ingestion points: The beans-prime.ts script executes beans prime and captures its standard output. This output is derived from the .beans/ directory and .beans.yml file within the user's project repository.
Boundary markers: The captured output is pushed directly into the output.system and output.context arrays using system.push(prime) and context.push(prime). There are no delimiters (e.g., XML tags or specific markdown blocks) or instructions for the AI to ignore embedded directives within this content.
Capability inventory: The skill enables the agent to execute various beans CLI commands, which interact with the local file system. The beans-prime.ts script uses a shell execution wrapper ($) to run commands.
Sanitization: No sanitization, escaping, or validation is performed on the output of beans prime before it is injected into the system prompt.
Risk: The SKILL.md file explicitly tells the agent that the output of beans prime "takes precedence over generic guidance here," which encourages the AI to follow potentially malicious instructions found in untrusted repositories.
[EXTERNAL_DOWNLOADS]: The skill instructs the user or agent to install the beans CLI from third-party sources that are not recognized as trusted organizations.
Evidence: brew install hmans/beans/beans and go install github.com/hmans/beans@latest in SKILL.md.
[COMMAND_EXECUTION]: The plugin beans-prime.ts automatically executes shell commands to check for the presence of the beans binary and configuration files.
Evidence: Usage of $ to run which beans, test -f, and beans prime in the BeansPrimePlugin export.

jb-beans