The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted project data and pillar opinions, which could theoretically contain malicious instructions.
Ingestion points: Reads content from SKILL.md files during catalog scanning and from .heyeddi/docs/workflow/opinions/ during workflow context loading.
Boundary markers: The skill implements a dedicated security utility in scripts/_untrusted_doc.py that wraps processed text in <<<UNTRUSTED_PROJECT_DOC>>> tags, explicitly instructing the agent to treat the content as data only and ignore embedded instructions.
Capability inventory: The skill has the ability to write to the .heyeddi/ directory and execute the gh CLI for update checks.
Sanitization: It uses structured JSON parsing for configuration and applies the aforementioned boundary markers to free-text pillar opinions to prevent accidental instruction following.
[COMMAND_EXECUTION]: The skill uses subprocess.run in scripts/_skills_update.py to invoke the GitHub CLI (gh) for checking version updates. This is implemented securely with shell=False to prevent command injection. The tool is rate-limited by a 24-hour throttle and only queries the vendor's official repository by default.
[EXTERNAL_DOWNLOADS]: The sync and check_skills_update tools detect available updates from the vendor's GitHub repository. The skill follows a 'never auto-update' policy, ensuring that the agent only provides an installation prompt for the user to manually review and approve before any external code is modified or added.

heyeddi