The Agent Skills Directory

[NO_CODE]: The skill package is composed entirely of Markdown instructions and templates. It does not include any scripts, binaries, or active configuration files that execute logic during skill operation.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data (such as statistics and learnings) by interpolating it into Markdown templates for report generation.
Ingestion points: Data for preset components like stats-table.md and learnings.md is provided by external callers.
Boundary markers: No explicit delimiters or "ignore" instructions are present around interpolated variables in the templates.
Capability inventory: The skill can deliver reports via email or print them to the chat surface using the Project API.
Sanitization: The instructions state that the Project API renders the Markdown and strips every attribute from the result, providing a level of protection against malicious payloads in the input data.
[DYNAMIC_EXECUTION]: Housekeeping instructions permit the agent to generate and execute temporary scripts to facilitate batch API operations.
Evidence: HOUSEKEEPING.md specifies that the agent "CAN write a throwaway script" to repeat requests over many items.
Context: The risk is mitigated by mandatory cleanup instructions requiring that such scripts be placed in temporary locations and deleted at the end of the session.
[SAFE]: The skill includes explicit security mandates for the protection of sensitive credentials.
Evidence: HOUSEKEEPING.md requires that the FOUNTAIN_API_KEY must never be written into logs, reports, or any file other than the protected key store.

fountain-reports