The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill interacts with sensitive credential information, such as API keys and workspace identifiers, stored in the user's configuration directory at ~/.config/exo/. The included Python script (scripts/exo-skill.py) is designed to read these secrets to authenticate requests to the exo workspace API. The instructions also direct the agent to help the user set up these credentials in configuration files if they are missing.
[COMMAND_EXECUTION]: The agent is instructed to execute a provided local Python script (scripts/exo-skill.py) to manage skill bundles and workspace state. Additionally, the skill's infrastructure allows for the definition of tasks that execute arbitrary shell commands via sh -c in the target environment, which the agent can configure during the 'build' or 'improve' phases.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from an external API (exo MCP server), including execution logs, tool results, and error messages, which are used to drive the 'debug' and 'improve' logic. This creates a surface for indirect prompt injection if a managed workflow produces malicious logs.
Ingestion points: Data is ingested through tool calls like list_runs, get_run_events, and summarize_run_events as specified in intents/debug.md and intents/improve.md.
Boundary markers: The instructions do not define explicit boundary markers or delimiters to isolate the ingested log data from the agent's core instructions.
Capability inventory: The agent has the capability to create and update workspace resources (tasks, workflows, skills) and trigger new runs, providing a pathway for injected instructions to affect the managed environment.
Sanitization: There is no evidence of specific sanitization or filtering of the ingested log text before it is analyzed by the LLM.
[DYNAMIC_EXECUTION]: The skill supports the creation of workflow steps with an entrypoint that runs via a shell. This allows the agent to dynamically generate and execute scripts within the context of the managed exo workspace.

ghost-exo