The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill architecture is designed to ingest and process content from external directories and third-party services, which creates a surface for indirect prompt injection attacks.
Ingestion points: Data enters the agent context via external pollers (Apple Photos, Apple Notes, Limitless) and monitored file system paths like Ingest/Clippings and Ingest/Articles as defined in the configuration examples (SKILL.md).
Boundary markers: The instructions do not include specific delimiters or "ignore embedded instructions" warnings to prevent the AI from obeying commands hidden within the ingested PKM data.
Capability inventory: The skill manages the ai4pkm CLI and coordinates multiple external execution engines, including claude_code, codex_cli, and gemini_cli (SKILL.md).
Sanitization: There are no documented steps for validating or escaping content retrieved from external sources before it is passed to the execution workers.

ai4pkm-helper