The Agent Skills Directory

[PROMPT_INJECTION]: The skill uses strong framing and mandatory instructions (e.g., 'MUST use for ANY user request', 'Iron Law') to override standard agent behavior and enforce its own goal-oriented logic. It explicitly instructs the agent to perform certain actions 'without asking the user', which can lead to reduced user oversight of automated tasks.
[COMMAND_EXECUTION]: Executes shell commands via the Bash tool to detect project metadata (using git rev-parse and git branch) and manage local directories (mkdir -p) for artifacts and goal tracking. These operations are limited to project environment detection and setup.
[PROMPT_INJECTION]: The skill processes untrusted user input and stores it in goal-tracking files and JSON artifacts, creating a significant indirect prompt injection surface.
Ingestion points: User requirements are written verbatim to files in memory/goals/ (e.g., SKILL.md template using {用户原始表述}) and JSON files in memory/artifacts/goal-oriented/.
Boundary markers: The file templates use markdown headers to delineate sections but do not include explicit instructions for the agent to ignore directives embedded within the captured user text.
Capability inventory: The skill has access to high-impact capabilities including Bash, Write, and Edit tools.
Sanitization: There is no validation or sanitization of input before it is stored or passed to the 'experience-manager' skill. The instructions specify that this data is eventually used to modify permanent configuration files like CLAUDE.md, AGENT.md, and MEMORY.md, which could allow an attacker to persist malicious instructions in the agent's long-term behavior.

goal-oriented