The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill captures user-supplied topics, summaries, and reasoning during conversations and stores them in local JSON files. This content is later rendered back into the agent's context during operations like render, stats, or analyze.
Ingestion points: The init, add-node, merge, and fork commands in scripts/topology.js ingest user-derived text via stdin.
Boundary markers: The structural summaries are re-injected into the agent's prompt without specific delimiters or "ignore embedded instructions" warnings.
Capability inventory: The skill possesses the ability to read and write files (JSON and Markdown) in the local filesystem.
Sanitization: While filenames are slugified to prevent traversal, the content of the nodes (summaries, reasoning) is stored and re-rendered without sanitization or escaping.
[DATA_EXFILTRATION]: The loadTree function in scripts/topology.js supports absolute file paths. If the file argument starts with a forward slash, the script accesses that path directly rather than scoping it to the intended trees/ directory. This allows the agent to be manipulated into reading any JSON file or writing JSON and Markdown files to arbitrary locations on the filesystem where the process has permissions, potentially exposing sensitive data to the agent's context.
[COMMAND_EXECUTION]: The skill uses a security-conscious design for its CLI interface, requiring the agent to pipe JSON-encoded arguments via stdin rather than passing them as shell arguments. This pattern effectively mitigates shell injection risks that often occur when user-controlled strings are concatenated into command lines.

decision-topology