The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user data (outcomes and acceptance criteria) and interpolates it into a complex 'Mayor-style' prompt template. This generated prompt is intended to control a persistent agent runtime. If the input data contains malicious instructions, they could influence the downstream agent's logic or security posture.
Ingestion points: The skill consumes caller-outcome and goal-acceptance as defined in the SKILL.md frontmatter.
Boundary markers: The template in references/goal-prompt.md uses angle-bracket placeholders for user input but does not specify delimiters or sanitization rules to isolate user text from the prompt's instructional logic.
Capability inventory: The skill specifies interaction with the bd tracker tool for persistent state and mutation, and the generated prompt is designed to orchestrate experiments with authority over internal tools.
Sanitization: No explicit validation, escaping, or filtering of the user-provided strings is described before they are included in the emitted prompt.
[COMMAND_EXECUTION]: The skill involves the execution of shell commands for validation and state tracking.
Evidence: The file scripts/validate.sh executes a bash script using exec bash.
Evidence: SKILL.md instructs the agent to 'verify bd context --json before mutation', which involves calling a CLI tool.
Evidence: SKILL.md provides a shell snippet using printf, head, and grep for output validation.
[DYNAMIC_EXECUTION]: The skill uses a validation script that determines the location of and executes another script at runtime based on its own file system position.
Evidence: scripts/validate.sh calculates REPO_ROOT using shell subshells and then executes a script located at $REPO_ROOT/skills/skill-builder/scripts/heal.sh.

craft-goal