The Agent Skills Directory

[PERSISTENCE_MECHANISMS]: The scripts/install.sh script is designed to modify the ~/.codex/AGENTS.md file, which is a global configuration file for the agent. By injecting rules into this file, the skill ensures its instructions are active across all future sessions without the user needing to explicitly invoke it.
[PROMPT_INJECTION]: The skill's instructions in SKILL.md explicitly direct the agent to bypass user oversight, stating 'Do not ask for separate confirmation merely because the destination is project docs, a permitted memory update, an existing skill, or a new skill' and 'Directly apply qualified maintenance actions instead of merely proposing them.' This reduces human-in-the-loop safety and allows the agent to autonomously modify the repository and system configuration.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect injection because it processes untrusted data from task outcomes (like logs or project files) and uses it to update durable knowledge or executable skills.
Ingestion points: Processes current task context, repository files, and project memory.
Boundary markers: No explicit instruction to treat external content as untrusted or to use delimiters when reading task data.
Capability inventory: Possesses the ability to write to project documents, update agent memory, and modify or create skills using the $skill-creator tool.
Sanitization: While it instructs to exclude secrets, it lacks mechanisms to sanitize or escape data that could contain malicious instructions.
[DYNAMIC_EXECUTION]: The skill instructions in SKILL.md specify the use of $skill-creator to modify existing skills or create new ones at runtime based on task lessons. This allows for the dynamic generation and execution of agent instructions based on potentially untrusted input.
[UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The install.md guide instructs users to run an npx command to download the skill from a remote GitHub repository (https://github.com/nangongwentian-fe/jay-skills). While this is a vendor-owned resource, the subsequent execution of a local shell script (scripts/install.sh) to modify system configuration files represents a risk if the source repository were compromised.

post-task-learning-review