The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute a variety of text-processing commands including grep, awk, sort, and uniq. These commands are used to extract character names and artifacts from prose files and to search for their occurrences across the project. While the parameters for these commands are derived from file content, the extraction logic (using strictly defined regex like [A-Z][a-z]{2,}) significantly limits the risk of shell injection.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and process untrusted user-provided content (fiction chapters in .md, .tex, .txt, and .rst formats). This creates an inherent surface for indirect prompt injection where malicious instructions embedded in the story text could attempt to influence the agent's behavior during the audit process.
Ingestion points: The skill reads arbitrary text from files matching the chapter routing patterns in references/routing.md.
Boundary markers: The skill does not explicitly define delimiters for the ingested text in its instructions, but it processes the data as discrete tokens for grep searches.
Capability inventory: The skill has access to Read, Bash, Grep, and Glob tools.
Sanitization: The entity extraction process uses restrictive regular expressions that effectively filter out most non-alphabetic characters before they are used in subsequent search commands.
[SAFE]: The skill demonstrates highly defensive design patterns. It explicitly states that it is read-only, refuses to edit chapters or story bibles, and instructs the agent not to install git hooks or spawn sub-agents. Furthermore, it explicitly ignores code files (.py, .js, etc.) to prevent accidental execution or modification of executable logic.

canon-check