The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill has a defined attack surface for indirect prompt injection as it ingests untrusted data from the repository.
Ingestion points: Processes repository source code, product materials, and conversation evidence to define domain terms (SKILL.md).
Boundary markers: Implements a mandatory 🔴 CHECKPOINT · 🛑 STOP section that requires explicit user approval for exact mutations before any file write operations occur.
Capability inventory: The skill is authorized to execute git commands and perform file writes to CONTEXT.md, docs/adr/, and the .tigerkit/ directory.
Sanitization: No automated programmatic sanitization or escaping of the ingested content is defined in the instructions beyond manual review.
[COMMAND_EXECUTION]: The skill utilizes shell commands for repository management and local script execution.
Executes Git commands to verify path exclusions and tracking: git ls-files -- .tigerkit .tigerkit/ and git check-ignore -q -- .tigerkit/ (references/artifact-paths.md).
Involves the execution of a repository-local Python helper script: scripts/durable_artifacts.py status (references/artifact-paths.md).
Uses framework-specific commands like choose and resolve for path management.
[DATA_EXPOSURE]: The skill explicitly handles application authentication and secret inputs (references/authentication.md, references/artifact-paths.md). It employs security hardening by using restricted directory and file permissions (0700 and 0600) and forbids the inclusion of credentials in evidence, Git history, or conversation logs, which aligns with secure secret management practices.

tk-domain