The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill defines a system that processes untrusted data streams to generate instructions for the agent, creating a surface for indirect prompt injection.
Ingestion points: Matches patterns against bash tool commands, file edit contents (new_text, old_text), and user_prompt data.
Boundary markers: The documentation does not describe the use of delimiters or isolation protocols for triggered rule messages.
Capability inventory: The skill documents a multi-step chain where rule output (markdown messages) directly influences the agent's subsequent tool usage and logic.
Sanitization: No sanitization or safety validation for rule messages or matched input is mentioned.
[COMMAND_EXECUTION]: The documentation suggests executing shell commands locally to verify regular expression patterns.
Evidence: Provides a python one-liner for testing: python3 -c "import re; print(re.search(r'your_pattern', 'test text'))".
[DATA_EXFILTRATION]: The skill identifies and lists multiple sensitive file paths as recommended targets for security monitoring rules.
Evidence: Mentions sensitive files such as .env, credentials, .pem, and ~/.aws/credentials.
[PERSISTENCE]: The skill facilitates the creation of persistent configuration files that influence agent behavior across sessions.
Evidence: Rules are stored in the .agent/ directory as .local.md files and are loaded dynamically whenever a tool is invoked.

writing-rules