The Agent Skills Directory

[PROMPT_INJECTION]: The system prompt in infra/agents/content-writer.prompt.ts contains an explicit instruction override that directs the agent to prioritize external files over its core instructions.
Evidence: The prompt states: "Repository conventions win over anything in this prompt. Read AGENTS.md (or CLAUDE.md) first... Repository conventions win over anything in this prompt."
[INDIRECT_PROMPT_INJECTION]: The agent is vulnerable to indirect prompt injection because it ingests and processes untrusted data from the repository to generate content.
Ingestion points: The agent reads data from files located in context/ (including positioning, proof points, insights, and objections) and cadence/log/ (weekly team logs) as seen in infra/agents/content-writer.prompt.ts.
Boundary markers: The agent lacks delimiters or specific instructions to isolate external data from its internal reasoning, increasing the risk of the model following instructions embedded within those files.
Capability inventory: The agent uses the claudeCode harness, which allows it to read and write files and execute GitHub commands like gh pr list and gh pr create.
Sanitization: The skill does not implement any escaping or filtering of the content read from the repository before processing it.
[COMMAND_EXECUTION]: The agent is designed to execute shell commands to manage its workflow in the repository.
Evidence: In infra/agents/content-writer.prompt.ts, the agent is instructed to run gh pr list --state open --search "in:title [linkedin-content] <week>" --json number,url to detect existing work.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of vendor-owned packages to function.
Evidence: The skill documentation in SKILL.md specifies requirements for @cargo-ai/cli and @cargo-ai/cdk.

linkedin-content