The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements an 'Inbox Sweep' protocol that ingests arbitrary file formats (including PDFs, images, and CSVs) from an unstructured drop zone to build a persistent wiki. This distilled knowledge is then used to orient the agent and guide future decisions, creating a surface for indirect prompt injection.
Ingestion points: The 02-DOCS/inbox/ directory is monitored for any raw file in any format (wiki-protocol.md).
Boundary markers: While .rscignore is used for scan boundaries, the skill lacks explicit instructions to the LLM to ignore potentially malicious directions embedded in the files it transcribes via vision or extraction tools.
Capability inventory: The skill can execute shell commands, perform remote code execution via npx, and modify the filesystem.
Sanitization: Extracted content is compiled into wiki articles without evidence of sanitization or instructions to filter for adversarial content.
[REMOTE_CODE_EXECUTION]: The skill interacts with external vendor-provided tools by executing npx @ericrisco/rsc consult and npx @ericrisco/rsc add to analyze project stacks and install new capabilities.
[COMMAND_EXECUTION]: The skill performs extensive shell-based operations, including workspace-wide scanning for credentials and imports, syntax validation of generated scripts using bash -n, and preflight checks for python3 availability.
[PERSISTENCE]: The skill establishes ongoing automated behavior by configuring scheduled tasks for daily curation, log maintenance, and automated inbox sweeps via the schedule skill.
[CREDENTIALS_UNSAFE]: The skill proactively scans the workspace for sensitive files (.env) and variable names (e.g., STRIPE_SECRET_KEY, POSTGRES_PASSWORD, DATABASE_URL) to identify providers, documenting these findings in local audit reports.

harness