The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill uses shell execution at load time (!) to determine the active persona and inject the contents of persona.md and nuance.md into the agent's context. This mechanism reads local files based on the value found in personas/_active.md.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted persona data from the file system and transforms it into new configuration files, creating a surface for indirect prompt injection.
Ingestion points: The skill reads personas/_active.md, personas/$ACTIVE/persona.md, and personas/$ACTIVE/nuance.md via dynamic context injection in SKILL.md.
Boundary markers: No delimiters or safety instructions are specified to separate the external content from the agent's primary instructions.
Capability inventory: The skill performs file reads (cat) at load time and contains instructions for file system writes (creating directories and writing .md files) at runtime.
Sanitization: The instructions do not include any steps for sanitizing, validating, or escaping the contents of the persona files before processing.

export