The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the bun runtime to execute various utility scripts, such as manifest-sync.ts and append-loop-result.ts, for managing project metadata and campaign ledgers.
[DATA_EXFILTRATION]: The scripts/lib/hosted-api.ts file reads configuration and credential files from the user's home directory (e.g., ~/.config/forsvn/api-key, ~/.config/forsvn/credentials.json) to authenticate telemetry and data requests to the vendor's API at api.forsvn.com.
[EXTERNAL_DOWNLOADS]: The skill makes network requests to api.forsvn.com to download content packs, retrieve project context, and upload metrics as part of its normal operation.
[PROMPT_INJECTION]: The skill ingests data from external sources like CRM exports and analytics platforms, which represents an indirect prompt injection surface.
Ingestion points: External metrics and CRM data are ingested through agents/metric-ingest-agent.md and agents/diagnosis-agent.md.
Boundary markers: The skill does not implement explicit boundary markers or delimiters for external data within its agent prompts to separate untrusted content from instructions.
Capability inventory: The skill has access to Bash, Write, and Edit tools, and includes scripts like manifest-sync.ts and append-loop-result.ts that can modify the filesystem.
Sanitization: scripts/append-loop-result.ts provides basic sanitization by rejecting inputs that contain tab or newline characters to protect the integrity of the project's TSV ledgers.

evaluate-campaign