The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructions in curate.md direct the agent to deploy sub-agent configurations (.claude/agents/brv-curate.md and .codex/agents/brv-curate.toml) that explicitly use permissionMode: bypassPermissions (for Claude Code) and sandbox_mode = "workspace-write" (for Codex). This is a direct attempt to circumvent the platform's security model and suppress human-in-the-loop permission prompts for shell command execution.
[PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection through its retrieval-augmented synthesis workflow.
Ingestion points: Untrusted data is ingested from Markdown and HTML files located in the .brv/context-tree/ directory when performing brv query or brv read operations.
Boundary markers: The skill lacks specified boundary markers or instructions to treat retrieved content as data only, increasing the risk that embedded instructions could influence agent behavior during synthesis.
Capability inventory: The skill possesses powerful capabilities including arbitrary shell command execution via the brv CLI, file system writes via brv curate, and network operations via brv vc push and brv vc pull.
Sanitization: There is no evidence of sanitization or validation of the retrieved content before it is processed by the agent's language model.
[COMMAND_EXECUTION]: The skill's primary functionality relies on executing the brv command-line utility for knowledge storage, retrieval, version control, and diagnostic operations.
[EXTERNAL_DOWNLOADS]: The SKILL.md file instructs users to install the byterover-cli package from the official npm registry, which is a well-known service.
[EXTERNAL_DOWNLOADS]: The vc.md file includes instructions for cloning project context trees from the vendor's domain at https://byterover.dev/.

byterover