The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to have the agent author and review devenv.nix, devenv.yaml, and .env files. These files contain executable Nix code and shell scripts (e.g., within enterShell, scripts, and tasks) that are executed when the agent invokes the devenv CLI. This creates a surface for indirect prompt injection where an attacker could provide a malicious configuration file that the agent then processes and executes.
Ingestion points: The agent is instructed to read devenv.nix, devenv.yaml, devenv.lock, and .env from the project directory.
Boundary markers: There are no specific delimiters or instructions provided to the agent to prevent it from obeying commands embedded within the data files it reads.
Capability inventory: The skill makes use of the devenv CLI, which can perform subprocess execution (devenv shell, devenv up, devenv test), file system writes (devenv init), and network operations (fetching flakes and dependencies).
Sanitization: No sanitization or validation of the ingested Nix code is specified beyond checking for evaluation errors via devenv info.
[PERSISTENCE]: The skill provides instructions for configuring shell auto-activation hooks in user profile files such as ~/.zshrc or ~/.bashrc. While this is a standard and documented feature of the devenv tool for maintaining environment state across sessions, it involves the modification of shell startup files to execute code upon directory entry.

devenv