The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest markdown files from a user-managed Git repository, which introduces a potential surface for indirect instructions.
Ingestion points: The agent is instructed to read AGENTS.md, PROFILE.md, MEMORY.md, and STATE.md at the start of a session, and other repository files on demand.
Boundary markers: A "Memory curation bar" is established, requiring all stored information to be Verified, Reusable, and Stable, which acts as a manual vetting process for ingested data.
Capability inventory: The skill utilizes Git commands (git pull, git push) and file-system operations (reading and writing markdown files) across its instructions and health-check scripts.
Sanitization: "Security red lines" are defined to explicitly exclude passwords, API keys, and private keys from the repository, though specific prompt-level sanitization for ingested content is not implemented.
[COMMAND_EXECUTION]: The skill uses standard system commands for repository management and structural validation.
Evidence: The agent is directed to use git pull --rebase, git push, and git status for synchronizing the data vault.
Scripts: Provided health-check scripts (scripts/vault-doctor.mjs and scripts/vault-doctor.sh) use benign local APIs and shell tools like wc, grep, and head to verify file existence and metadata without network interaction.
[SAFE]: The skill demonstrates security best practices by explicitly warning against credential exposure and providing transparent, minimal scripts for repository health checks. No obfuscation, persistence mechanisms, or unauthorized privilege escalation attempts were detected.

personal-os