The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external files including source code (.ts, .py) and project documentation (proposals, guides) to map the current system.
Ingestion points: Reads files from proposals/, specs/, guides/, and arbitrary source paths using exec("cat ...") and file tools.
Boundary markers: None identified. The skill does not instruct the agent to use delimiters or warnings when processing these inputs.
Capability inventory: Includes exec (file reading/listing), write (file creation), edit (file modification), and search tools.
Sanitization: None. The content of read files is processed directly into the agent's context.
[COMMAND_EXECUTION]: The skill instructions direct the agent to use an exec tool for file system operations, specifically invoking commands like ls -A and cat to explore the project structure and read file contents.
[DATA_EXFILTRATION]: The skill accesses sensitive project data, including source code and internal design documents. While no network exfiltration was detected, the skill has broad read access to the local development environment.
[AUTONOMOUS_EXECUTION]: The skill defines a 'Headless' mode triggered by phrases like 'run headless' or 'just proceed'. In this mode, the agent auto-confirms scoping proposals and selects routing decisions without user intervention, reducing the opportunity for human oversight during file system modifications.

write-a-spec