The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill has a broad attack surface for indirect prompt injection as it ingests and processes various user-provided markdown files and uses their content to generate revision plans and update other files.
Ingestion points: Processes story.md, chapter files in chapters/, scene files in scenes/, character/location/system/arc files, continuity/state.md, and research notes in research/.
Boundary markers: No specific prompt delimiters or instructions to ignore embedded commands are specified when reading untrusted file content.
Capability inventory: Performs Git operations (add, commit, tag), file system modifications (move, split, merge, delete via restore), and executes shell commands via the story CLI and local Node.js scripts.
Sanitization: No explicit sanitization or filtering of external content before interpolation into prompts or commands is described.
[COMMAND_EXECUTION]: The skill utilizes shell commands via a custom story CLI and local Node.js scripts (specifically node ../story-maintenance/scripts/story.js) to perform maintenance and structural edits. It also uses git for versioning and snapshots. While these are legitimate tools for the skill's purpose, they represent powerful capabilities that could be exploited if the agent follows malicious instructions embedded in the project files.

revision-continuity