The Agent Skills Directory

[PERSISTENCE]: The skill provides detailed instructions for setting up system-level cron jobs (Method 2: System Cron) to invoke the agent CLI automatically. This configuration allows the agent to maintain a persistent presence and execute commands across sessions and system reboots without user intervention.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external, untrusted sources such as social media engagement and outreach email responses.
Ingestion points: Data entering through /money-social (engagement monitoring) and /money-outreach (email follow-ups) as described in the Operations Schedule in SKILL.md.
Boundary markers: The instructions do not specify the use of delimiters or 'ignore embedded instructions' prompts when handling external content, although general 'Safety Guardrails' are mentioned for actions.
Capability inventory: The agent possesses extensive capabilities, including executing shell commands via the CLI, interacting with financial APIs (Stripe), and sending emails (SendGrid).
Sanitization: There is no mention of sanitizing, escaping, or validating external inputs before they are processed by the LLM or passed to subsequent tools.
[COMMAND_EXECUTION]: The skill documentation includes a comprehensive list of highly destructive commands, such as rm -rf, git push --force, DROP TABLE, terraform destroy, and supabase db reset. While the skill suggests a confirmation gate for these actions, Providing these patterns to an autonomous agent increases the risk of catastrophic failure or malicious exploitation if the guardrails are bypassed.
[PRIVILEGE_ESCALATION]: The instructions for system cron jobs suggest piping output to /var/log/money-ops.log. On many Unix-like systems, writing to the /var/log directory is restricted to the root user or accounts with administrative privileges, which may lead users to run the autonomous agent or its cron jobs with elevated permissions.

money-ops