The Agent Skills Directory

[PROMPT_INJECTION]: The file AGENTS.md contains an instruction ('RULE 0
THE FUNDAMENTAL OVERRIDE PREROGATIVE') that directs the AI agent to disregard the provided guidelines and follow user instructions even if they contradict those guidelines ('I AM IN CHARGE, NOT YOU').
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data in the form of agent session logs.
Ingestion points: The cm reflect and cm onboard commands read and process session data via the cass search engine (src/reflect.ts, src/onboard.ts).
Boundary markers: The LLM prompts used for session reflection (PROMPTS.reflector) and diary extraction do not employ explicit delimiters or warnings to ignore instructions embedded within the untrusted session content.
Capability inventory: The skill is capable of executing arbitrary shell commands and interacting with the file system (src/cass.ts, src/utils.ts).
Sanitization: While the skill redacts sensitive credentials using a dedicated sanitizer (src/sanitize.ts), it does not sanitize content for natural language instructions or prompt injection attempts.
[COMMAND_EXECUTION]: The skill invokes external binaries and shell commands using execFile and spawn to interface with the cass tool and other utilities (src/cass.ts, src/utils.ts).
[REMOTE_CODE_EXECUTION]: The installation process and update command (src/commands/update.ts) utilize a curl | bash pattern to execute a script downloaded from the project's remote repository.
[EXTERNAL_DOWNLOADS]: The skill references and downloads setup scripts and dependencies from raw.githubusercontent.com and bun.sh.

cm