The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute the shell command date +%F to retrieve the current system date, which is used to evaluate time-based triggers.
[PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection attacks by reading and processing data from several external memory files, including out/ideate/tracker.md, out/verdict/*.md, and out/scout/tracker.md. Malicious instructions embedded within these trackers could potentially be interpreted by the agent when the content is rendered in the chat.
Ingestion points: Data is ingested from project-specific memory files located in the out/ directory and its subfolders.
Boundary markers: The instructions mention "quoting the exact tracker line," which provides a visual delimiter but does not functionally isolate the content from the agent's logic.
Capability inventory: The agent is authorized to read multiple files across the project workspace and execute shell commands to get system time.
Sanitization: There are no explicit instructions for the agent to sanitize, filter, or escape the content retrieved from the trackers before presenting it to the user or determining if a condition has fired.

revisit