The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill analyzes session transcripts which may contain untrusted data. It explicitly includes guardrails in action/reflect/ and action/recall/ that instruct agents to treat transcripts as untrusted data, ignore embedded instructions, and confine tool use to cited contexts to prevent obedience to malicious content within those files.
[PERSISTENCE]: The action/setup/SKILL.md action configures model settings stored in ~/.agents/loegg/models.md and may create a symlink in ~/.claude/rules/ to allow the configuration to be auto-loaded by the agent harness. This is the intended purpose of the setup utility for maintaining cross-session configuration and is explicitly presented to the user.
[COMMAND_EXECUTION]: The skill uses standard development tools such as git, gh (GitHub CLI), and platform-native subagent tools (e.g., Task in Cursor, Agent in Claude Code) to perform its functions. It also provides a utility script util/decision-log/scripts/log.sh for logging, which includes sanitization to prevent formula injection in spreadsheet software.
[DATA_EXFILTRATION]: While the skill accesses external data sources (e.g., Slack, Linear, Datadog) via MCP tools, it does so to fulfill explicit user requests for historical investigation or debugging. No evidence of unauthorized network transmission or sensitive data theft was found.
[PRIVILEGE_ESCALATION]: The skill does not attempt to use sudo or bypass system security. Its home-directory modifications are restricted to its own configuration folder or documented harness-specific directories.

loegg