The Agent Skills Directory

[PROMPT_INJECTION]: The AGENTS.md file contains explicit behavioral overrides, such as 'RULE 0
THE FUNDAMENTAL OVERRIDE PREROGATIVE,' which instructs agents to disregard other rules if commanded. This pattern is designed to force agent compliance and bypass established constraints.
[PROMPT_INJECTION]: The skill implements an 'Autonomous Curation Engine' (ACE) that processes raw session logs to extract rules. This creates an indirect prompt injection surface (Category 8) where malicious instructions embedded in session data could be 'learned' by the agent as permanent playbook rules.
Ingestion points: Session logs are ingested via src/diary.ts and src/reflect.ts using the cass search engine.
Boundary markers: Absent; trajectories are processed as raw content for insight extraction.
Capability inventory: System command execution (execSync, spawn), network access for LLM APIs, and optional remote machine access via ssh (found in src/cass.ts).
Sanitization: Present; src/sanitize.ts redacts API keys and common secrets before data is passed to the LLM.
[EXTERNAL_DOWNLOADS]: The README.md and installation guides promote the use of remote shell scripts piped to bash (curl | bash) for installing the tool and its runtime (Bun). While these originate from trusted or vendor-owned sources, they represent a remote code execution vector common in developer tools.
[COMMAND_EXECUTION]: The core functionality relies on executing system commands through child_process modules to interact with the cass search binary and manage local file locking.

cm