The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read from and automatically update context files (e.g., .agents/em-context.md and .agents/reports/[name].md). This creates a persistent feedback loop where untrusted conversation data is saved to the filesystem and subsequently treated as authoritative context in future interactions, potentially allowing for the injection of instructions.
Ingestion points: Files located in .agents/em-context.md and .agents/reports/[name].md are read at the start of the interaction (defined in SKILL.md).
Boundary markers: The instructions include a qualitative directive to "Save stable facts and patterns, not guesses, transient frustration, or unresolved interpretations," but no technical delimiters are enforced.
Capability inventory: The skill requires file read and write capabilities to manage the .agents directory.
Sanitization: There is no explicit sanitization or filtering logic for data written to the persistent context files beyond the instruction to save "stable facts."
[DATA_EXPOSURE]: The skill is designed to manage and store sensitive personnel data, including performance ratings, PIP status, and feedback history. It explicitly directs the agent to store this information in the .agents/ directory, which may contain PII (Personally Identifiable Information).
[EXTERNAL_DOWNLOADS]: The skill provides links to external resources for further reading, including the author's newsletter on newsletter.manager.dev and the MGMT Playbook hosted on beehiiv.com. These are legitimate references associated with the skill's domain.

performance-reviews