The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructions do not contain any patterns attempting to bypass safety filters or override system behavior. It includes a 'Guardrails' section that explicitly restricts the skill's operations to maintainer-approved actions and prevents it from acting as a general help surface for non-admin users.
[DATA_EXFILTRATION]: No network operations or data transmission patterns were detected. The skill actively protects data by managing .gitignore configurations that exclude local environment settings (.workflow/local.yml), local feedback (.feedback/), and personal workspace areas from being committed to source control.
[COMMAND_EXECUTION]: While the skill logic involves file system operations such as directory creation and file writing, these are strictly limited to the resolved knowledge and worktree directories. The instructions emphasize that these actions must only be performed after generating a dry-run and receiving explicit maintainer approval.
[REMOTE_CODE_EXECUTION]: There is no evidence of the skill downloading or executing remote code. It mentions dependency skills (e.g., knowledge-assistant) but explicitly states these must be provided by the agent's runtime environment and are never copied or installed by the skill itself.
[CREDENTIALS_UNSAFE]: No hardcoded credentials or secrets were found. The skill documentation includes clear warnings against storing sensitive data like credentials or private customer information within the knowledge base.

knowledge-workflow-admin