The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external project files and provides summaries to the agent, which could contain malicious instructions.
Ingestion points: The skill reads from log/plans/, log/ session files, and .context/current-focus.md (SKILL.md).
Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present when reading these files.
Capability inventory: The skill uses Read, Glob, and Bash(ls*, cat*) tools (SKILL.md).
Sanitization: There is no evidence of sanitization or filtering of the content read from these files before it is processed by the agent.
[COMMAND_EXECUTION]: The skill is configured to use restricted shell commands to perform its diagnostic tasks.
Evidence: The allowed-tools configuration explicitly permits Bash with a restricted scope of ls* and cat* for directory traversal and file inspection.

session-health