The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external information such as web content, issue reports, and logs. While this introduces a surface for indirect prompt injection, the skill includes a dedicated 'Retrieved Evidence Boundary' protocol that instructs the agent to treat all external data as non-authoritative evidence, preventing it from overriding internal rules or scope.\n
Ingestion points: natural language read from issues, PR reviews, CI logs, command output, and web content (SKILL.md).\n
Boundary markers: The 'Retrieved Evidence Boundary' section in SKILL.md explicitly instructs the agent to ignore instruction-like text in data.\n
Capability inventory: Authorized tools include local Git commands, local test/benchmark execution, and file edits within a scoped research worktree (SKILL.md).\n
Sanitization: Instructions in references/persistence.md mandate the removal of secrets and credentials from any tracked research artifacts.\n- [COMMAND_EXECUTION]: The skill possesses authorized local command execution capabilities, including running tests, benchmarks, and Git operations. These actions are strictly confined to a dedicated research branch or worktree, preventing side effects on the primary codebase or user configuration. The skill explicitly forbids destructive actions or production mutations.\n- [DATA_EXFILTRATION]: The skill implements strong safeguards against data exfiltration. Its instructions explicitly forbid accessing secrets or credentials (references/persistence.md) and prohibit the use of network or Git tools to publish or push data to external services without explicit per-action authorization.\n- [SAFE]: The skill incorporates comprehensive security design principles, including isolated environments for experiments, mandatory sanitization of persistent state, and clear boundaries for autonomous actions. All external sources cited are for informational provenance and do not involve remote code execution.

tk-autoresearch