The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Bash tool to execute git rev-parse to determine the project root and cat to read the contents of a local status file located at ~/.origin/sessions/_status/<project>.md.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes data from untrusted or external sources and presents it directly to the model's context.
Ingestion points: The skill reads from a local markdown status file and retrieves memories and revisions from the mcp__plugin_origin_origin__context and mcp__plugin_origin_origin__list_pending_revisions tools.
Boundary markers: No delimiters or "ignore embedded instructions" warnings are used when outputting the retrieved content; the agent is explicitly told to render sections "verbatim".
Capability inventory: The agent has access to Bash for shell command execution and several MCP tools that can modify memory state (recall, accept_revision, dismiss_revision).
Sanitization: There is no evidence of filtering, validation, or escaping of the content retrieved from the status file or memory tools before it is incorporated into the prompt.

brief