The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from existing repository files such as AGENTS.md, CLAUDE.md, and contents of the docs/monorail/ directory.
Ingestion points: The agent is instructed in SKILL.md to read the contents of AGENTS.md and CLAUDE.md, and to perform directory listings and file existence checks (ls, test -f) within the local workspace.
Boundary markers: The instructions do not define delimiters or provide specific warnings to the agent to disregard potential instructions embedded within the files it reads.
Capability inventory: The skill possesses the capability to write new files to the filesystem (docs/monorail/work-tracker.md, docs/monorail/domain.md), edit existing markdown configuration files (CLAUDE.md or AGENTS.md), and execute basic shell commands.
Sanitization: There is no evidence of sanitization, filtering, or validation performed on the data retrieved from the repository files before it is processed by the agent.
[COMMAND_EXECUTION]: The skill employs standard shell commands (ls -R, ls, test -f) to perform environment discovery and verify the presence of specific documentation. These operations are restricted to file system exploration and do not involve network connectivity or complex processing.
[PROMPT_INJECTION]: The skill contains instructions designed to bypass standard user review checkpoints, specifically directing the agent to "never pause to ask the user to confirm the plan" and "Write immediately after presenting — no confirmation, no waiting for edits." This behavior reduces the user's opportunity to verify the agent's actions before the file system is modified.

rail-setup