The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the agent to run a local shell script (scripts/load-preferences.sh) to process and merge configuration files. While the script is part of the skill package and performs specific JSON merging tasks using jq, executing scripts from a skill directory is a notable capability.
[INDIRECT_PROMPT_INJECTION]: The skill supports a four-tier configuration system that loads settings from .agents/office.json and ~/.agents/office.json. One of the supported fields, 'principles', allows for free-text rules that are directly applied to the agent's detection logic. This creates a surface for indirect prompt injection if a user is tricked into using a malicious configuration file in their project.
Ingestion points: The skill loads configuration data from files in the project root (.agents/office.json, .agents/office.local.json) and the user's home directory (~/.agents/office.json, ~/.agents/office.local.json) via a bash script.
Boundary markers: The instructions do not specify any delimiters or safety warnings for the interpolation of the 'principles' field into the agent's prompt.
Capability inventory: The skill possesses the ability to execute its own shell scripts (scripts/load-preferences.sh) and read local configuration files, but it does not have broader system access or network capabilities.
Sanitization: There is no evidence of sanitization or validation logic for the free-text 'principles' field before it is used to influence the agent's operational instructions.

tropes