The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes historical logs and session data which may contain malicious instructions designed to influence the agent's output.
Ingestion points: The skill reads recent agent sessions, task summaries, memories, and screen history records from paths like $AGENT_HOME/memories/ and $CODEX_HOME/memories/ (as specified in SKILL.md).
Boundary markers: There are no explicit instructions or delimiters provided to the agent to distinguish between valid task patterns and malicious commands that might be embedded within the historical data being analyzed.
Capability inventory: The skill possesses the ability to write to the filesystem through the skill-creator tool and automation configuration utilities, and it can search the local environment using rg, find, and ls.
Sanitization: The instructions lack specific requirements for sanitizing or validating content extracted from history before it is incorporated into new skill or automation assets.
[COMMAND_EXECUTION]: The skill uses local system utilities and specialized creation tools to perform its functions.
Evidence: It employs rg (ripgrep), find, and ls to search through memory registries, task summaries, and user skill directories to identify patterns of repetition.
Evidence: It utilizes platform-specific tools like skill-creator and Codex automation tools to dynamically generate and install new executable assets on the local system. This capability is mitigated by the requirement for explicit user confirmation before any modifications are made.

workflow-packager