The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes uncontrolled project data, creating a surface for indirect prompt injection.
Ingestion points: The agent reads from docs/literature-review/, meeting-notes/, log/, MEMORY.md, source code, and .context/project-recap.md (SKILL.md, Phase 1).
Boundary markers: The instructions do not specify the use of delimiters or 'ignore embedded instructions' warnings when processing these raw inputs.
Capability inventory: The skill possesses Write, Edit, and Bash(mkdir*) capabilities, allowing it to modify project files and a global vault based on processed data (SKILL.md, Phase 3 & 5).
Sanitization: There is no evidence of filtering or sanitization of input data before it is synthesized into new markdown articles.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill accesses a centralized vault directory outside the immediate project workspace.
Sensitive file paths: The skill reads and writes to ~/vault/atlas/ to sync project metadata (SKILL.md, Phase 5). While this is a documented feature for the 'Atlas' ecosystem, it involves cross-directory access to potentially sensitive user data.
[COMMAND_EXECUTION]: The skill uses shell tools but within a restricted scope.
Restricted tools: The Bash tool is constrained to mkdir* operations, which limits the risk of arbitrary command execution or shell-based privilege escalation (SKILL.md, Frontmatter).

compile-knowledge