The Agent Skills Directory

[PERSISTENCE]: The skill implements a 'heartbeat' system and optional timers to manage 'long-horizon' goals. It instructs the agent to create or update automations on the host using idempotency keys derived from goal references, effectively maintaining execution capabilities across sessions through scheduled 'navigation wakes' (file: SKILL.md).
[INDIRECT_PROMPT_INJECTION]: The skill defines a 'Goal Prompt' structure that ingests untrusted user requests for 'Outcome' and 'Plan' details and requires these to be passed verbatim to the create_goal tool and the $coder execution surface.
Ingestion points: User requests for goal setting and multi-session work (file: SKILL.md).
Boundary markers: The skill uses structural headers (e.g., Outcome, Hard refs, Plan, Acceptance) but does not provide delimiters or instructions to ignore malicious embedded content within the user-supplied fields.
Capability inventory: Access to $coder execution tool, create_goal tool, and the lev exec command (file: SKILL.md).
Sanitization: No evidence of sanitization or validation of user-provided content before interpolation into the verbatim goal prompt.
[DYNAMIC_EXECUTION]: The skill instructs the agent to resolve execution flows dynamically as lev://exec/<flow> and passes these identifiers to the lev exec command for execution (file: SKILL.md).
[METADATA_POISONING]: The references/long-running.md file references 'official OpenAI guidance' using non-standard domains (e.g., learn.chatgpt.com, developers.openai.com) to ground its autonomous goal-management and persistence behaviors, which may mislead users or evaluators regarding the source of these practices.

goal-exec