The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill implements a 'Custom-skill Resolver' in forms/SKILL.md (Step 7). It instructs the agent to read .dailybot/profile.json and, if a mapping exists, to dynamically load and follow instructions from a computed file path (e.g., .agents/skills/dailybot-custom/<name>/SKILL.md). While scoped to the local filesystem, this allows instructions to be redirected based on repository configuration.
[REMOTE_CODE_EXECUTION]: The skill provides instructions to install the Dailybot CLI. In SKILL.md and shared/auth.md, it mentions a human-friendly curl | bash command for the official script at https://cli.dailybot.com/install.sh. This is a vendor-owned resource. Crucially, the skill also defines a 'defense-in-depth verified install' method that includes cross-origin diffing against GitHub, SHA-256 integrity verification, and optional Cosign signature checks before execution.
[INDIRECT_PROMPT_INJECTION]: The skill has a large ingestion surface, reading data from form responses, chat messages, and task descriptions.
Ingestion points: forms/SKILL.md, checkin/SKILL.md, tasks/SKILL.md, and messages/SKILL.md read user-generated content from the Dailybot API.
Boundary markers: The skill explicitly instructs the agent in shared/untrusted-content.md and tasks/SKILL.md (Step 0) to treat all API strings as 'quoted data' and never as instructions.
Capability inventory: The agent has capabilities to run shell commands via the CLI, send emails, and post chat messages.
Sanitization: The skill provides strict guidelines on quoting and attributing data to prevent it from influencing the agent's logic flow.
[CREDENTIALS_UNSAFE]: The skill manages API keys and Bearer tokens for Dailybot.
It stores them in ~/.config/dailybot/ with 0600 owner-only permissions.
It enforces a strict 'never commit' policy for .dailybot/env.json using a fatal CLI guard that refuses to run if the file is tracked by git.
email/SKILL.md implements a mandatory pre-send scan that blocks emails containing patterns matching AWS keys, Stripe secrets, Slack tokens, or private keys.
[PROMPT_INJECTION]: Automated scanners detected injection markers like 'ignore previous instructions' and 'system: you are now in admin mode' in shared/untrusted-content.md and tasks/SKILL.md. Technical analysis confirms these are benign instructional examples used to teach the agent how to identify and ignore malicious payloads in user-generated data.

dailybot