The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface through two primary mechanisms:
Annotation Parsing: The flow-updater agent (agents/flow-updater.md) is explicitly instructed to scan for and execute commands found inside HTML comments (annotations like ) within flow definition files. If these files are modified by an external source, an attacker could embed malicious instructions that the agent would follow during an update cycle.
Context Threading: The execution engine (references/workflows/go.md) threads the outputs of previous steps into the prompts of subsequent steps via a context.md file. If a task produces malicious output, it could influence the behavior of later steps in the pipeline.
Evidence Chain:
Ingestion points: flow.md and implementation/step-N.md (via update.md), and the handoff log context.md (via go.md).
Boundary markers: The system uses HTML comment markers and Markdown section headers (e.g., ## Flow context so far), though the updater is explicitly designed to process content within these boundaries.
Capability inventory: Orchestrated subagents and the updater agent have significant capabilities, including Read, Write, Edit, Glob, Grep, and Bash tools.
Sanitization: No explicit sanitization or filtering of external instructions or step outputs is performed before injection into agent prompts.
[PERSISTENCE]: The skill implements a persistence mechanism for storing global flow definitions and cross-project state in the user's home directory at ~/.codevoyant. It also modifies the project's .gitignore file to manage the visibility of the local .codevoyant symlink. While this is functional behavior for the tool, it represents persistent storage outside the immediate project scope.
[DYNAMIC_EXECUTION]: The save.md and new.md workflows generate new Markdown-based skill instruction files (SKILL.md and step-N.md). These files contain instructions that are later loaded and executed by the AI agent platform. This dynamic generation of instructions is template-based but allows for user-supplied strings and parameters to be baked into executable AI prompts.

flow