The Agent Skills Directory

[PROMPT_INJECTION]: The skill operates on an 'auto-invoke' model, triggering proactively based on 'decision moments' detected in the session conversation. This creates a surface for indirect prompt injection (Category 8).
Ingestion points: The skill ingests untrusted data from the active session conversation, which may include content from externally sourced files or user-provided text.
Boundary markers: Absent. The instructions do not specify the use of delimiters or warnings to ignore potentially malicious instructions embedded within the conversation data being synthesized.
Capability inventory: The skill utilizes Bash to perform file-write operations (cat > file) and repository modifications (git add, git commit) as seen in SKILL.md.
Sanitization: The skill employs a quoted heredoc ('DECISION_EOF') to prevent shell variable expansion and explicitly instructs the agent to avoid command substitution patterns like $(...) or backticks.
[COMMAND_EXECUTION]: The skill utilizes Bash to create directories, write markdown files, and perform git commits. While the commands are restricted to specific tools and include anti-injection guidelines, the ability to autonomously modify the repository's history and persistent state is a significant capability that could be abused if the agent is misled by the conversation context.

record-decision