The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to automatically ingest and follow instructions from an external repository defined in a local .project-brain.json file without user intervention.
Ingestion points: The agent reads .project-brain.json from the workspace and content from the remote repository, including agent-guide.md and graphify-out/wiki/index.md (SKILL.md).
Boundary markers: Absent. The agent is instructed that the marker file is an "unconditional instruction" and to consult the brain "before substantive reasoning or action."
Capability inventory: Shell command execution via gh (GitHub CLI), repository cloning, API requests, and pull request creation.
Sanitization: Absent. The skill warns against printing tokens but does not specify escaping or validation for instructions or identifiers retrieved from the repository content.
[COMMAND_EXECUTION]: The agent is instructed to construct and run shell commands using variables parsed from a local configuration file, which could lead to command injection if the repository or branch strings are malicious.
Evidence: gh repo clone OWNER/REPO TEMP_DIR -- --depth 1 --branch BRANCH and gh api repos/OWNER/REPO/commits/BRANCH rely on values parsed from .project-brain.json (SKILL.md).
[DATA_EXFILTRATION]: The skill interacts with the GitHub CLI to check authentication status and fetch repository contents, creating a path for potential credential or data exposure if outputs are mismanaged.
Evidence: Use of gh auth status and gh api with raw JSON acceptance headers to read repository metadata and contents (SKILL.md).

project-brain