The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted repository data (READMEs, docs, ADRs, and plans) to generate vault notes. This creates an indirect prompt injection surface where malicious instructions in the repository files could potentially influence agent behavior.
Ingestion points: Files including README*, docs/, adr/, plans/, .cursor/plans/, and .agent/context/ (specified in SKILL.md).
Boundary markers: The skill uses a ## Manual heading to delimit user-owned content and instructs the agent never to edit or delete content below it.
Capability inventory: The skill performs file read/write operations and executes git commands (SKILL.md, RESYNC.md).
Sanitization: Note titles are sanitized to be filename-safe, and instructions mandate summarizing content without copying code blocks.
[COMMAND_EXECUTION]: The skill executes standard Git commands to manage versioning and detect changes for its re-sync functionality.
Evidence: Commands include git rev-parse HEAD, git status --porcelain, git diff, and git log --follow (SKILL.md, RESYNC.md). These are scoped to the repository context and are necessary for the primary functionality of identifying stale notes.
[DATA_EXPOSURE]: The skill contains strict negative constraints against accessing sensitive files, reducing the risk of accidental data leakage.
Evidence: Instructions in SKILL.md and README.md explicitly forbid reading or copying .env files, key/cert files, credentials, tokens, or data samples. It also restricts vault path discovery to a configured location rather than scanning the disk.

seed-vault-from-repo