The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests failure stubs from .moai/lessons-inbox.jsonl to generate curation candidates. Because these stubs contain logs from tool executions that could be influenced by external or untrusted data, there is a risk that malicious instructions could be injected into the agent's evolution and proposal pipeline.
Ingestion points: .moai/lessons-inbox.jsonl (read and sliced in drain.sh).
Boundary markers: The data is formatted as JSON and processed using jq.
Capability inventory: The skill uses Bash, Grep, and Glob to perform file operations and write to the .moai/state/ and memory/ directories.
Sanitization: The skill uses a frequency gate and severity filtering to reduce noise, but does not explicitly sanitize the text of the failure stubs for prompt injection patterns.
[PROMPT_INJECTION]: The backlog_check.sh script is designed to emit a <system-reminder> tag to stderr. This mechanism provides a way for scripts to inject instructions directly into the orchestrator's context, potentially bypassing standard input controls.
[DYNAMIC_EXECUTION]: The skill executes multiple local shell scripts (drain.sh, reflect.sh, backlog_check.sh, backlog_check_test.sh) to perform deterministic logic. These scripts utilize common utilities like jq, awk, find, and sed to manipulate files within the project's state and memory directories.
[OBFUSCATION]: The tier4_firing_test.sh script employs simple string concatenation ("enable""TriggerInjectionWrites") to assemble a variable name, effectively obscuring the literal token from simple static analysis checks that look for the enableTriggerInjectionWrites identifier.

hns-lsel-curator