The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests configuration data including settings, integrations, and webhooks from the TwinMind API. If these external configurations contain malicious instructions, they could influence agent behavior during the migration process.
Ingestion points: TwinMind API endpoints (/settings, /integrations, /webhooks) accessed in scripts/export-config.ts and scripts/import-config.ts.
Boundary markers: No explicit delimiters or instructions to ignore embedded content are present in the scripts.
Capability inventory: The skill utilizes Bash(curl:*), Write, and Edit tools, allowing for network and filesystem operations.
Sanitization: No sanitization or validation of the ingested webhook URLs or integration configurations is performed before writing to disk or sending back to the API.
[DYNAMIC_CONTEXT_INJECTION]: The skill uses the exclamation-backtick syntax to execute shell commands at load time to gather environment metadata.
Evidence: !npm list 2>/dev/null | head -20 and !pip freeze 2>/dev/null | head -20 are executed in SKILL.md to display the current environment state.
Context: These discovery commands are used for environment auditing and do not perform network exfiltration or access sensitive user files.
[DYNAMIC_EXECUTION]: The skill generates and instructs the agent to run TypeScript scripts that perform file operations and API interactions.
Evidence: Scripts such as scripts/export-config.ts and scripts/import-config.ts use fs.writeFileSync and fs.readFileSync to manage local configuration backups.
[COMMAND_EXECUTION]: The skill executes shell commands to interact with cloud infrastructure and external APIs.
Evidence: The skill uses aws secretsmanager update-secret to manage credentials and curl to verify API connectivity to api.twinmind.com.

twinmind-upgrade-migration