The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses shell commands in SKILL.md to identify the project environment (git root, branch, and commit) and to initialize a local storage directory at memory/artifacts/pilot. These operations are limited to environment awareness and local file management.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8). Evidence chain:
Ingestion points: User-provided task descriptions and data from memory/artifacts/experience-manager/experience-result.json are processed in SKILL.md.
Boundary markers: Absent; user input and historical experience data are interpolated into planning prompts without delimiters or instructions to ignore embedded commands.
Capability inventory: The skill has access to Bash (for filesystem/git operations) and Read (for accessing other skill files).
Sanitization: Absent; the skill lacks logic to filter or escape content from user requests before using it to generate keyword lists or execution plans.
[DATA_EXFILTRATION]: No network exfiltration patterns or sensitive file access (e.g., credentials or configuration files) were detected. All file operations are restricted to the local memory/artifacts/ workspace.

pilot