The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it processes untrusted local content from Markdown documents and user activity logs.
Ingestion points: Untrusted data enters the agent context through scripts/context.py (during file searches) and scripts/workspace_rollouts.py (during workspace discovery).
Boundary markers: Present. The system prompt in scripts/workspace_llm.py includes explicit delimiters and instructions to the model to treat input as evidence only and to ignore any embedded commands.
Capability inventory: The skill can write files (scripts/schema.py), execute local Python scripts (scripts/mem.py), and run git commands (scripts/workspace.py).
Sanitization: Present. scripts/workspace_rollouts.py implements a _clean_text function that identifies and removes common injected metadata tags and agent-specific prefixes from activity logs.
[COMMAND_EXECUTION]: The skill performs local command execution for internal dispatching and system integration.
scripts/mem.py uses os.execvp to replace the current process with the Python interpreter or the uv tool for task execution.
scripts/workspace.py and scripts/workspace_llm.py use the subprocess module to execute git for repository metadata and the platform's codex CLI for workspace synthesis.
All executions are restricted to local paths and use platform-provided sandboxing features where available (e.g., --sandbox read-only).
[EXTERNAL_DOWNLOADS]: scripts/schema.py uses the uv manager to ensure standard dependencies are present at runtime. All identified packages are well-known libraries sourced from official registries.
[DYNAMIC_EXECUTION]: scripts/schema.py utilizes the Jinja2 templating engine to generate documentation and project records. The engine is configured with StrictUndefined to prevent silent errors and uses a fixed set of local template files.

mem