The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted, free-form text from a local file (inbox.md) and converts it into structured tasks and commands. This is a classic Indirect Prompt Injection surface where malicious instructions in the inbox could influence the agent's behavior.
Ingestion points: Content from .agents/tasks/inbox.md is read via the tasks inbox command.
Boundary markers: The instructions explicitly mandate human-in-the-loop confirmation ("Present the draft tasks to the user for confirmation... Only create tasks after explicit confirmation") and clarify that vague items should prompt questions rather than immediate execution.
Capability inventory: The skill uses the tasks CLI to create, update, and close tasks, and uses shell redirection (echo. > ...) to modify or clear project files.
Sanitization: The skill relies on manual user review and confirmation of the 'drafted' tasks to sanitize the input from the inbox before final state changes are made.
[COMMAND_EXECUTION]: The skill relies on a pre-installed or local tasks CLI tool for all task management operations. It also utilizes shell commands to manage file state, such as clearing the inbox file using echo. > .agents/tasks/inbox.md (Windows) or > .agents/tasks/inbox.md (Unix).
[SAFE]: The tasks serve command initiates a local web UI dashboard. While this is a network-related operation, it is documented as a standard feature of the task system for local visualization and does not involve external data exfiltration or remote downloads.

task-system