The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructs the agent to search and query prior journal entries. If an attacker can influence the content of a journal entry (e.g., via a pull request review or by compromising a data source the agent journals about), they could embed instructions meant to influence the agent's behavior when it later queries that journal.
[COMMAND_EXECUTION]: The skill utilizes bundled Python scripts (query_journals.py and update_journal_index.py) to manage its data. These scripts perform standard file system operations (reading, writing, and directory traversal) within the .journals directory. While these are legitimate functions for a journaling skill, they constitute the mechanism through which potentially untrusted journal content is processed and returned to the agent's context.
[DATA_EXPOSURE]: The skill explicitly instructs the agent: 'Do not record secrets, credentials, tokens, private keys, or sensitive personal data.' This is a positive safety instruction, though users should remain aware that the journal is stored locally within the repository's .journals/ directory.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect injection surface.
Ingestion points: The query_journals.py script reads .md files from the .journals/ directory (SKILL.md, scripts/query_journals.py).
Boundary markers: The instructions do not define specific XML-style tags or delimiters for journal content to separate it from the agent's system instructions.
Capability inventory: The skill has the capability to write to the local file system (creating entries) and read from it (querying/indexing).
Sanitization: The scripts parse metadata and text but do not perform explicit sanitization or filtering to remove potential prompt injection sequences from the journaled data.

journalist