The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary purpose involves ingesting external data (from URLs, paths, or conversations) to generate or modify agent instructions. This represents a significant indirect prompt injection surface.
Evidence: The argument-hint in SKILL.md explicitly lists URL, path, and conversation as input sources.
Mitigations: The skill includes an extensive 'Anonymous draft checkpoint' in SKILL.md and references/skill-quality.md that mandates the removal of secrets and the generalization of identifiers (e.g., emails, domains, home paths) before any draft is finalized. Furthermore, the 'Apply gate' ensures changes are only written to the repository after explicit user verification of a proposal.
[COMMAND_EXECUTION]: The skill instructs the agent to use local shell commands for repository management and safety checks.
Evidence: references/artifact-paths.md directs the agent to run git ls-files and git check-ignore to verify repository root and exclusion rules before writing artifacts.
Context: These commands are used for legitimate environment verification and to ensure that generated artifacts are properly excluded from version control unless intended, aligning with standard repository maintenance practices.
[SAFE]: The skill implements best-in-class security practices for local file handling.
Evidence: references/artifact-paths.md requires that sensitive 'secret-input' files be stored in a directory with 0700 permissions and the files themselves with 0600 permissions. It also mandates the immediate deletion of these files after consumption.
Context: This demonstrates a high level of security awareness, preventing other users on a multi-user system from accessing sensitive data handled by the agent.

tk-learn