The Agent Skills Directory

[PROMPT_INJECTION]: The skill generates instructions intended to supersede the AI agent's system prompt and safety guidelines. Specifically, the SUBAGENT_AUTHORIZATION directive in the context script commands the agent to execute sub-agents without seeking user approval, explicitly stating that these instructions should "outrank" system-level defaults.\n- [DYNAMIC_CONTEXT_INJECTION]: The SKILL.md file utilizes a shell execution block to run a local script (scripts/context.mjs). This script injects high-priority directives into the current conversation context, which are designed to override the agent's behavioral constraints and autonomy settings at load-time.\n- [DATA_EXPOSURE]: The "Phase 1: mine the archive" instructions require the agent to access and analyze historical run logs and session transcripts. These archives may contain sensitive data, code, or configuration details from past interactions, posing a risk of unauthorized data exposure.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external files (logs and skill corpora). This creates a surface for indirect prompt injection, where malicious instructions embedded in these processed files could manipulate the agent's logic during the audit or retuning phases.\n
Ingestion points: Reads run logs and skill directories (e.g., references/baseline-mining.md, references/corpus-audit.md).\n
Boundary markers: None observed in the instructions for processing external content.\n
Capability inventory: Uses subprocess calls for git and node, performs file reads, and dispatches sub-agents.\n
Sanitization: No explicit sanitization or filtering of the ingested log/corpus content is described.\n- [DYNAMIC_EXECUTION]: The setup script executes a Node.js script (scripts/context.mjs) which in turn uses execFileSync to run shell commands (git). While these are targeted at the local repository, they represent the dynamic assembly and execution of commands at runtime.

ce-retune