The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted data from the local vault which could contain malicious instructions.
Ingestion points: Files located in <vault>/library/ and the link graph in <vault>/graphify-out/graph.json.
Boundary markers: Absent; there are no instructions to the agent to treat vault content as data only or to ignore embedded instructions.
Capability inventory: The skill possesses file read capabilities via grep and the ability to execute a local Python script.
Sanitization: Absent; the content retrieved from the vault is interpolated into the agent's context without filtering or escaping.
[COMMAND_EXECUTION]: The skill executes a local Python script (<plugin>/scripts/isolation.py) to verify if the vault is sealed, which constitutes command execution of local resources.

ask