The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains explicit instructions to override standard agent behavior and safety protocols. Specifically, it commands the agent to perform 'Silent Execution', providing 'NO acknowledgement' to the user, requiring 'NO confirmation', and insisting the agent 'MUST end silently' and 'NEVER block on user'. These instructions are designed to suppress user oversight and bypass standard interaction safety filters.
[COMMAND_EXECUTION]: The skill uses the schedule_task action to dynamically generate and execute new task sessions. The instructions for these scheduled tasks are constructed using data read from external sources (the PROACTIVE.md file via recurring_read). This pattern allows for the execution of arbitrary instructions if the source file is manipulated by an untrusted actor.
[REMOTE_CODE_EXECUTION]: The 'SCHEDULED Execution' workflow involves building a complex instruction string for a new agent session. Because this string incorporates variable content from external data without visible sanitization or validation, it creates a risk of instruction injection that could lead to remote code execution in subsequent sessions.
[DATA_EXFILTRATION]: While no explicit exfiltration logic is present, the skill possesses an attack surface for indirect prompt injection.
Ingestion points: Reads task definitions from PROACTIVE.md via recurring_read and fetches web content via web_search and web_fetch.
Boundary markers: Absent; there are no delimiters or warnings to ignore instructions embedded within the read data.
Capability inventory: Can read files (read_file), search the web (web_search), and schedule new tasks (schedule_task).
Sanitization: Absent; data from the files is directly interpolated into instructions for scheduled tasks.

heartbeat-processor