The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill maintains state in markdown files located at .agent/context/decision-maps/. It loads these files back into context during 'Resume' sessions. While this creates a surface for indirect prompt injection (where instructions from a previous session or external data could be re-ingested), the skill does not contain logic to execute these instructions as code or perform unauthorized network operations.
Ingestion points: Reads existing maps from .agent/context/decision-maps/<slug>.md.
Boundary markers: Uses markdown headers (e.g., ## #1:) to separate tickets.
Capability inventory: Restricts itself to writing markdown files and invoking other specific agent skills (grilling, prototype, research).
Sanitization: No explicit sanitization or escaping of the ingested ticket content is mentioned.
[SAFE]: The skill follows standard practices for state management within an agent's context directory. It does not hardcode credentials, perform direct network exfiltration, or use obfuscated code. The use of the disable-model-invocation: true flag in the frontmatter is a configuration setting that limits the skill's execution environment.

decision-mapping