The Agent Skills Directory

[PROMPT_INJECTION]: The scripts/context.mjs script generates directives such as SUBAGENT_AUTHORIZATION and AUTONOMY_DIRECTIVE_CHECK that explicitly instruct the agent to override or disregard harness-level constraints and system prompt defaults regarding autonomy and tool usage.
[COMMAND_EXECUTION]: The Setup section in SKILL.md executes a bash script block that performs environment probing and runs a local Node.js utility (scripts/context.mjs).
[COMMAND_EXECUTION]: The skill utilizes execFileSync within scripts/context.mjs to run git commands for extracting repository metadata, including branch and commit information.
[DATA_EXFILTRATION]: The skill provides functionality to publish artifacts to external services like ht-ml.app and Proof. Although these actions require user confirmation, they involve transmitting repository-derived content to external platforms.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting data from git log, pull requests, and project documentation.
Ingestion points: Git history, pull request metadata, and project documents in directories like plans/ or solutions/ (processed in references/agents/work-recap-scout.md).
Boundary markers: The skill does not define clear boundary markers or instructions to ignore embedded commands within the ingested data.
Capability inventory: The skill possesses capabilities for repository inspection (git), file system writes, and network-based publishing.
Sanitization: There is no evidence of sanitization or filtering for the data retrieved from external repository sources.

ce-explain