The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is architected to ingest and act upon external data signals such as email content, calendar details, and CI failure logs to generate proactive recommendations. This introduces a vulnerability surface where maliciously crafted external content could potentially influence the agent's behavior.
Ingestion points: signals.md identifies external communication (emails) and project signals (CI logs) as primary inputs for detection.
Boundary markers: boundaries.md defines a four-level ladder (DO, SUGGEST, ASK, NEVER) to limit autonomous behavior and ensure user oversight.
Capability inventory: The skill has instructions to modify local state files and can modify core workspace configuration files (SOUL, AGENTS, TOOLS, HEARTBEAT) with user consent.
Sanitization: There are no explicit instructions for the sanitization or validation of untrusted data before it is processed by the agent.
[COMMAND_EXECUTION]: The setup and template files include shell commands intended for environment initialization and security hardening.
Evidence: setup.md and memory-template.md contain mkdir, touch, and chmod commands (e.g., chmod 700, chmod 600).
Context: These commands are used to establish a private directory for state storage and to enforce restrictive file permissions, representing standard security practices for local data management.

proactivity