The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill supports a 'team mode' that ingests content from external Slack channels and threads. This creates a surface for indirect prompt injection where an attacker could attempt to influence the agent's behavior via Slack messages. The skill proactively mitigates this by providing explicit instructions to the agent to treat all Slack content as data rather than instructions, and by identifying the local operator as the sole trusted source.
Ingestion points: Slack messages and threads processed via the poll-slack skill (references/team.md).
Boundary markers: The skill relies on natural language instructions to the agent rather than programmatic delimiters.
Capability inventory: The agent has access to file system operations (ADRs, logs, scratch files), Slack posting, and inherited tools like bash or web search.
Sanitization: Includes specific instructions in references/team.md to treat external content as data and requires explicit operator or owner approval for critical transitions.
[DATA_EXPOSURE]: The skill manages persistence and continuity by writing to files in the user's home directory.
Evidence: Investigation logs are stored in ~/.manifest-dev/logs/ (references/LOG.md), and user preferences (Taste) are written to ~/.claude/CLAUDE.md (references/TASTE.md). These are legitimate uses for cross-session state management.
[DYNAMIC_EXECUTION]: In 'canvas mode', the skill dynamically generates a self-contained HTML/JavaScript file in the host's temporary directory to visualize the investigation progress.
Evidence: Described in references/CANVAS.md using the template in assets/canvas-template.html.
Safety: The implementation in assets/canvas-template.html includes an esc function to escape HTML special characters (&, <) in reflected data, reducing the risk of cross-site scripting (XSS) when the user opens the local file.
[REMOTE_CODE_EXECUTION]: The skill defines an 'autonomous mode' where the agent can self-answer questions and explore discoverable resources (code, docs, web).
Evidence: references/autonomous.md and SKILL.md. This uses standard agent capabilities rather than downloading and executing untrusted scripts.

figure-out