The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external data provided by the agent to store as context records, creating an ingestion surface. This is mitigated by strict record size limits (4KB), content validation that rejects strings containing known secret markers or executable tags, and a mandatory "untrusted_context" label on all retrieved data.
Ingestion points: The context_capture tool defined in scripts/mcp_server.py and implemented in scripts/context.py allows the agent to store external strings.
Boundary markers: The skill instructions in SKILL.md and references/context-contract.md mandate the use of a specific serialization envelope and the authority=untrusted_context label.
Capability inventory: The skill is limited to local file operations (SQLite) and self-contained CLI script execution.
Sanitization: The _contains_dangerous function in scripts/context.py performs a blacklist check against common API key prefixes (e.g., AKIA, ghp_) and HTML/script markers (e.g., <script, #!).
[COMMAND_EXECUTION]: The skill instructions define a CLI fallback that executes the local scripts/context.py script. This execution is Confined to the skill's own internal logic for managing the context database and does not involve arbitrary command execution, shell piping, or the use of user-supplied arguments in a shell context.
[DATA_EXFILTRATION]: While the skill manages a local database located at ~/.codex/nerd-context/context.sqlite3, it does not perform any network operations. It employs security best practices to protect this data, including file permission hardening (0600), directory restriction (0700), and symlink checks in _reject_symlink to prevent path traversal or unauthorized file access.

nerd-context