The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is built around reading and acting upon content from a file named RELIANCE.md across multiple sessions.
Ingestion points: The HAND/MAIN zone in RELIANCE.md is described as a human inbox where entries must be read and acted upon before any other logic. The ECO zone also involves reading and syncing external files listed as 'hot files'.
Boundary markers: The system uses Markdown headers (e.g., ## MAIN) to separate zones, but instructions explicitly tell the agent that 'Human intent overrides machine drift' and to 'Act on each entry', creating a vulnerability if the file content contains malicious instructions.
Capability inventory: The skill has access to powerful tools including Bash, Edit, Write, and Skill (the ability to invoke other skills).
Sanitization: There is no evidence of sanitization or validation for the content read from the RELIANCE.md file or the 'hot files' monitored for drift.
[COMMAND_EXECUTION]: The skill's allowed-tools include Bash, Write, and Edit. While these are used for ledger maintenance and task management, their presence alongside the ingestion of external file content increases the impact of a successful indirect prompt injection attack.

meta-prompt