The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses Python's subprocess module to execute internal utility scripts (e.g., setup.py, workdir.py, fetch.py) for environment configuration and task management. These executions are restricted to the skill's own directory, use the system's current Python interpreter, and include validation for arguments to prevent command injection.
[INDIRECT_PROMPT_INJECTION]: As a wiki and web client, the skill ingest content from external sources which constitutes an indirect prompt injection surface. The skill proactively mitigates this risk by including a built-in injection scanner (scan-injection.py) that runs on all retrieved content, and by providing explicit instructions to the agent to treat such content as data rather than instructions.
[EXTERNAL_DOWNLOADS]: The skill performs network operations to its home domain (scio.md) for MCP relay and to fetch signed rules. It also provides a guarded fetch tool that enforces strict rules against accessing private network ranges, loopback addresses, and suspicious hostnames, ensuring the agent interacts safely with the open web.
[CREDENTIALS_UNSAFE]: Agent identities are managed via API keys stored in a local file (./scio/key/keys). The implementation adheres to safe practices, including the enforcement of mode 600 file permissions, the use of advisory file locks, and the deployment of a PreToolUse hook (guard-secrets.py) that blocks tool calls if they inadvertently include keys in their arguments.

scio