The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill uses the ! syntax in SKILL.md to execute shell commands at load time. Specifically, it executes logic to determine an active persona and then reads multiple files (persona.md, nuance.md, accounts.md) from the local filesystem. This logic runs before the AI processes the instructions and replaces the placeholder with the content of these files.
[DATA_EXFILTRATION]: The skill is configured to automatically read accounts.md and include its contents in the agent's context. Depending on the environment, this file could contain sensitive account identifiers, configuration, or credentials, leading to potential data exposure to the LLM or downstream systems.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection because it ingests untrusted content from the personas/ directory without sanitization.
Ingestion points: Content is read from personas/_active.md and subsequent persona files into the prompt context via shell commands in SKILL.md.
Boundary markers: Absent. The content of external files is concatenated directly into the instruction stream without delimiters or instructions to ignore embedded commands.
Capability inventory: The skill allows file writing to the content/drafts/ directory and utilizes shell execution via dynamic context injection.
Sanitization: Absent. No filtering or validation is performed on the content read from the personas/ files before it is injected into the context.

content