The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill provides detailed guidance for the agent to ingest and analyze potentially untrusted data from various system sources, creating a surface for indirect prompt injection attacks where instructions embedded in processed data could override agent behavior.
Ingestion points: Instructions direct the agent to read from .agents/transcripts/ (historical conversation logs), .agents/user/memo/ (user-uploaded files), and ../.agents/threads.jsonl (the cross-workspace thread index).
Boundary markers: The documentation lacks instructions for implementing delimiters or security warnings when handling content from these historical or external files.
Capability inventory: The platform environment grants the agent access to powerful capabilities such as Bash, ExecuteCode (Python), Write/Edit (filesystem access), and vault (secret management).
Sanitization: No sanitization or filtering logic is provided for content retrieved from transcripts or memos before it is used to inform the agent's reasoning.
[COMMAND_EXECUTION]: The documentation explicitly describes how the agent can use Bash and ExecuteCode tools to interact with the sandbox environment, including details on persisting background jobs and accessing files in sibling workspaces through path traversal (e.g., ../<sibling>/).

langalpha-doc