The Agent Skills Directory

[DATA_EXPOSURE]: The skill accesses the file ~/.agentic-learnings.json in the user's home directory. This file stores persistent session insights, patterns, and historical context which may contain sensitive information from previous agent interactions.
[DYNAMIC_EXECUTION]: The skill generates and executes dynamic Workflow scripts to orchestrate complex fan-out research tasks. This involves coordinating multiple agent() calls and synchronization barriers at runtime based on the user's research query.
[INDIRECT_PROMPT_INJECTION]: The skill researches arbitrary codebase files and external documentation, exposing the sub-agents and synthesis process to potentially malicious instructions embedded in the data.
Ingestion points: Raw files from the codebase (read via the Read tool without limits), design documents in thoughts/*/design-docs/, and the ~/.agentic-learnings.json historical file.
Boundary markers: The instructions contain a 'documentarian' constraint to describe only existing code, but the skill lacks explicit formatting delimiters or 'ignore embedded instructions' warnings for the data being ingested.
Capability inventory: The skill can spawn sub-agents, perform web searches via web-search-researcher, execute dynamic workflow scripts, and write files to the thoughts/ directory.
Sanitization: There is no evidence of sanitization, filtering, or escaping of the ingested codebase content before it is processed by the analysis sub-agents.

researching