The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a local binary (ataru or lovcode) via scripts/ataru_index.py. The execution uses subprocess.run with list-based arguments, which avoids shell injection risks. The binary resolution logic follows a defined order (environment variables, PATH, and standard application paths) and includes a version check to ensure only compatible versions are run, preventing unexpected GUI behavior.
[PERSISTENCE]: The skill implements a local persistence mechanism through scripts/profile_store.py, which manages a JSON profile. It employs atomic writes to prevent data corruption and features a blocklist for sensitive keys (e.g., 'token', 'secret', 'password') to prevent the accidental storage of credentials in the profile.
[INDIRECT_PROMPT_INJECTION]: The skill processes local Ataru session history manifest data to report statistics such as session counts and indexing progress. The implementation explicitly avoids reading message bodies for reports, limiting the exposure to potentially malicious content embedded in the processed data.
[SAFE]: The skill's operations are localized to the user's machine, involving no network exfiltration or external code downloads. The metadata and instructional workflow are consistent with its stated purpose of managing a local indexing tool.

lov-ataru-indexing