The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes natural language requests and project context to populate a shared user profile, which creates a potential surface for indirect prompt injection if malicious instructions are embedded in the project files or profile data.
Ingestion points: User natural language requests and shared profile data defined in references/user-profile.md.
Boundary markers: SKILL.md includes explicit 'Execution boundary' instructions and triggers to limit activation to specific user requests.
Capability inventory: The skill uses scripts/profile_store.py for file read and write operations on the local profile JSON.
Sanitization: The profile_store.py script implements a blacklist of sensitive keywords (SENSITIVE_PARTS) to prevent the persistence of credentials, tokens, or secrets.
[COMMAND_EXECUTION]: The skill includes Python scripts (scripts/profile_store.py and scripts/validate_skill.py) designed to be executed by the agent for profile persistence and source validation. These scripts are confined to managing the local environment and do not perform arbitrary code execution.
[CREDENTIALS_UNSAFE]: While the skill manages user profiles, it includes a defensive mechanism in scripts/profile_store.py that specifically detects and blocks the storage of sensitive keys such as 'api_key', 'token', and 'password' in the persistent profile store.

lov-five