The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill uses the !command syntax in SKILL.md to execute shell scripts when the skill is loaded. The command ACTIVE=$(cat personas/_active.md 2>/dev/null || echo "default"); cat "personas/$ACTIVE/persona.md" 2>/dev/null reads files from the local filesystem to populate the agent's context.
[DYNAMIC_CONTEXT_INJECTION]: The shell command uses variable substitution ($ACTIVE) where the variable's value is derived directly from the contents of personas/_active.md. If the content of this file is manipulated, it can result in arbitrary file reads within the personas/ directory tree.
[INDIRECT_PROMPT_INJECTION]: The skill presents an indirect prompt injection surface by blindly incorporating external data into its operational context.
Ingestion points: Data is ingested from personas/_active.md and personas/$ACTIVE/persona.md at load time via shell execution.
Boundary markers: The content of these files is injected directly into the prompt without any delimiters, markers, or instructions to ignore embedded commands.
Capability inventory: The skill allows for file writing to content/trends/ and reading from the filesystem.
Sanitization: There is no evidence of sanitization, escaping, or validation of the file content before it is processed by the agent.

trend