The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructions state that the user's '99_Meta/structure-doctrine.md' file is 'the law' and must be 'read live, every session', creating a surface for indirect prompt injection. If this file contains malicious instructions, they could override the agent's core safety logic.
Ingestion points: Reads behavioral rules from '99_Meta/structure-doctrine.md' and configuration from 'IT-Systems' notes (SKILL.md).
Boundary markers: No delimiters are used to wrap external content, and the agent is directed to treat the vault content as a 'constitution' with higher authority than the skill's own memory (SKILL.md).
Capability inventory: The skill can execute database commands via 'lark-cli' and perform file writes to append analysis snapshots to local vault notes (SKILL.md, references/changing-the-base.md).
Sanitization: There is no evidence of content validation or sanitization for the data retrieved from the vault or the database (SKILL.md).
[CREDENTIALS_UNSAFE]: A hardcoded identifier for a master template base ('Yt2WbfTeQa0tjQsjMUwlfaEvgXb') is present in 'references/changing-the-base.md'. While used for safety comparison to avoid modifying the master template, hardcoding tokens in skill files is a poor security practice.
[COMMAND_EXECUTION]: The skill logic involves assembling and executing commands using 'lark-cli' (e.g., 'lark-cli wiki +node-get') to interact with cloud-based databases (references/changing-the-base.md).

performance-analysis