The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection by design. It reads content from untrusted local files to build a project context, which is subsequently injected into the system prompt of future sessions.
Ingestion points: commands/init.js and hooks/session-start.js read project metadata and goals from files such as package.json, README.md, and GEMINI.md within the current working directory.
Boundary markers: While data is often displayed within markdown code blocks, the hooks/session-start.js script explicitly instructs the agent to display the content verbatim as its first message, increasing the likelihood of the agent following instructions embedded in that data.
Capability inventory: The agent has the ability to execute Node.js scripts provided by the skill, perform file system operations, and run git commands.
Sanitization: No sanitization, filtering, or instruction-detection logic is applied to the ingested text before it is stored in context.json or injected into the prompt.
[COMMAND_EXECUTION]: The skill relies on the execution of local Node.js scripts and system git commands to manage project state.
The SKILL.md instructions guide the agent to invoke specific scripts in ~/.gemini/skills/ck/commands/ using node.
commands/shared.js contains a runGit helper that executes git via child_process.spawnSync to generate activity summaries based on session timestamps.

ck