The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes Markdown files from the local filesystem to create new tasks, which introduces a surface for untrusted data to influence the agent's instructions. Ingestion occurs in references/create-from-markdown.md via the $dendron tool. The skill attempts to mitigate this using specific boundary markers, including a Task: header and a structured <agtask-bootstrap version="2"> JSON trailer. The agent's capabilities to execute CLI commands and manage thread lifecycles are exposed to this ingested content. Sanitization is limited to paraphrasing and CLI-side prompt normalization.
[PERSISTENCE]: The skill configures multiple agent hooks in assets/hooks.json for SessionStart, UserPromptSubmit, Stop, and PostCompact. These hooks execute a local CLI tool to monitor and record turn history in the ledger database, providing persistent activity tracking across sessions.
[COMMAND_EXECUTION]: The skill workflows frequently execute a local Python CLI (./scripts/agtask) to interact with the task ledger, manage Git worktrees, and perform project lookups. The install-skill script also executes the skillz CLI and handles local file writes to ~/skillz.json to register the skill.
[EXTERNAL_DOWNLOADS]: In references/audit.md, the skill describes a 'Sites mode' that interacts with Cloudflare D1, a well-known hosted database service, for managing tasks. This involves network communication with external infrastructure for task state auditing.
[METADATA_POISONING]: The assets/hooks.json file and the install-skill script contain hardcoded absolute file paths specific to the author's local environment, which may cause configuration issues or unexpected behavior in different environments.

agtask