The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the observations.md file, which is populated by another command (/observe). This file could contain instructions that attempt to influence the agent's behavior when they are 'drained' during the retro process.
Ingestion points: The agent reads the file $VAULT_ROOT/Profile/observations.md and processes its content.
Boundary markers: No specific delimiters or safety warnings are specified for the contents of the observations file.
Capability inventory: The skill allows the agent to edit files, change settings, rewrite other skills, and commit changes across multiple repositories (~/Repos/skills, ~/dotfiles).
Sanitization: The skill includes a human-in-the-loop requirement ('Hassan accepts, redirects, or rejects. Nothing is applied on the agent's own authority'), which acts as a primary control against malicious output.
[COMMAND_EXECUTION]: The instructions direct the agent to resolve environment variables and interact with the file system and version control across several sensitive directories.
Evidence: The skill operates on ~/dotfiles, ~/Repos/skills, and the vault root, involving file edits and git commits.

retro