The Agent Skills Directory

[DATA_EXPOSURE]: The skill reads business context from ~/.pipa/profile.md. This file is used to provide durable project context and is not considered a standard sensitive system path.
[COMMAND_EXECUTION]: The skill refers to pipa-tools and pipa-time-tracking for record creation and updates. These tools are scoped to the agent's application environment and appear to be internal abstractions for managing time records.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data such as invoices and contract terms, which presents a potential injection surface.
Ingestion points: External project documents including invoices, payment notes, contract terms, and budget baselines are processed by the skill (referenced in references/getting-paid.md).
Boundary markers: The instructions do not define explicit boundary markers (like XML tags or delimiters) for external content, though they do require source citation.
Capability inventory: The skill can perform external writes to financial and time-tracking systems via composio and pipa-time-tracking.
Sanitization: There is no explicit requirement for sanitizing external document content before processing.
Mitigation: The skill implements a mandatory human-in-the-loop guardrail, stating that no financial records can be created or updated without explicit user approval. This effectively mitigates the risk of automated exploitation via indirect injection.

pipa-get-paid