The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill uses the exclamation-backtick syntax (!ACTIVE=$(cat personas/_active.md 2>/dev/null || echo "default"); ...) to execute shell commands at load time. It reads the personas/_active.md file and uses its content to dynamically construct file paths for subsequent cat commands without validation.
[INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted external data which could contain malicious instructions.
Ingestion points: The files personas/$ACTIVE/persona.md and personas/$ACTIVE/nuance.md are read and injected into the prompt.
Boundary markers: Absent. The content of these files is directly appended to the agent's context without delimiters or instructions to ignore embedded commands.
Capability inventory: The skill possesses shell execution capabilities through dynamic context injection and filesystem read access.
Sanitization: None observed. Content from external files is loaded raw into the session.
[PROMPT_INJECTION]: The instructions command the agent to "Adopt this persona's voice, tone, and decision-making style for the rest of the session", which serves as a persistent override of the agent's baseline identity and safety constraints.
[COMMAND_EXECUTION]: The skill executes multiple cat commands to read filesystem data during the initialization phase via the dynamic context feature.

introduce