The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted user data (ideas, requirements, plans) to drive a Socratic clarification process. This creates a surface for indirect prompt injection where malicious instructions embedded in the user's input could attempt to influence the agent's behavior.
Ingestion points: User input provided during the initial $clarify invocation and subsequent conversational turns as described in SKILL.md and WORKFLOW.md.
Boundary markers: The instructions mandate presenting questions in a structured "round" format (e.g., Q1, Q2) and maintaining internal state via a socratic engine, providing some structural delimiters between instruction and data.
Capability inventory: The skill can perform file writes to the .scratch/ directory and can route requests to other capabilities such as light-research (network/read access) or light-to-questionnaire.
Sanitization: There are no explicit instructions within the skill files for escaping or validating the content of user-provided messages before they are processed by the engine.
[SAFE]: The skill implements several safety-oriented design patterns:
Explicit Invocation: Requires a specific token ($clarify) to start, preventing accidental activation by general user text.
Confirmation Gates: Explicitly requires user confirmation before completing a session or writing handoff files to the filesystem.
Scoped File Access: Restricts file writing to a localized .scratch/ directory.
Least Privilege: Explicitly avoids automatic chaining of other user-invoked skills and requires separate authorization for fact-finding tasks involving external research.

clarify