The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run to execute external analysis tools (ast-grep) and for its own integration tests. These executions use fixed argument lists and verified binaries, minimizing risks of shell injection.
[INDIRECT_PROMPT_INJECTION]: The skill processes external content through its capture mechanism. It includes explicit instructions for the agent to treat this content as data rather than commands and provides Markdown normalization to prevent structural confusion. This is a standard risk for knowledge management tools, mitigated here by clear architectural separation between captured sources and maintained knowledge.
[DATA_EXPOSURE]: File operations are restricted to a user-defined knowledge vault (defaulting to ~/second-brain). The skill manages an internal SQLite search index and Markdown files, but does not access sensitive system directories like .ssh or .aws or exfiltrate content over the network.
[DYNAMIC_EXECUTION]: The skill implements a codegraph command that dynamically identifies code structures in a project using ast-grep. The output is formatted as Markdown for the wiki. This behavior is documented and serves the primary purpose of the skill.

second-brain