The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's core functionality involves reading markdown files from a local directory and applying them as instructions to modify the AI's persona and behavior.
Ingestion points: Personality instructions are loaded from the data/ directory (e.g., data/dev.md, data/chef-marco.md) and injected into the agent's context as shown in the SKILL.md and INTERNAL.md workflow.
Boundary markers: The skill lacks explicit boundary delimiters to isolate persona instructions from system prompts, essentially treating the content of the .md files as authoritative instructions.
Capability inventory: The agent is granted file-system access to read and write markdown files within the skill's data folder to support persona switching and custom creation.
Sanitization: The creator-workflow.md enforces basic alphanumeric validation for filenames to prevent path traversal, though it does not sanitize the contents of user-defined persona fields.
[NO_CODE]: The skill is implemented entirely through markdown prompts, JSON metadata, and documentation. It does not carry any executable scripts or binary dependencies, which significantly limits the risk of traditional code execution attacks.

personas