The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes existing documentation files that contain a designated 'Manual Notes' section intended for user-owned content. This creates a surface where malicious instructions could be embedded in data that the agent is required to read.
Ingestion points: Existing markdown documents located in the repository's documentation directories (e.g., $DOCS_ROOT/specs/ and $DOCS_ROOT/flows/).
Boundary markers: The skill identifies user-owned content using the ## Manual Notes heading and the preservation marker [keep this for the user to add notes. do not change between edits].
Capability inventory: The skill possesses capabilities for reading and writing files and executing a local Python script for validation.
Sanitization: While the instructions explicitly command the agent to preserve this section without modification, there is no mechanism to prevent the agent from accidentally following instructions contained within the user-provided text.
[COMMAND_EXECUTION]: The skill requires the execution of a local Python script (./scripts/validate_flow_doc.py) to perform automated structural validation on generated 'flow-doc' artifacts. This script is provided as part of the skill package and does not exhibit malicious behavior, focusing instead on privacy-preserving checks such as detecting absolute local paths.

specy