The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill design involves a 'brain job' that processes arbitrary data from external sources (feeds, APIs, webhooks) relayed by a mechanical script. This architecture is inherently susceptible to indirect prompt injection attacks.
Ingestion points: Untrusted data enters the agent's context through notification messages as detailed in references/pattern-mechanical-brain.md.
Boundary markers: The provided instructions and templates lack guidance on using delimiters or system-level instructions to ignore embedded commands within the ingested data.
Capability inventory: The documentation in references/pattern-mechanical-brain.md highlights that jobs can be configured with allowedTools (e.g., 'Bash') to auto-approve tool execution, which removes human-in-the-loop oversight during automated runs.
Sanitization: There are no requirements or examples for sanitizing, escaping, or validating the external content before it is processed by the LLM.
[COMMAND_EXECUTION]: The skill provides bash script templates to interact with the system environment and the duoduo CLI. These scripts are used to poll data and trigger the agent via the session notify command (references/pattern-mechanical-brain.md).
[PERSISTENCE]: The skill documents the use of standard system scheduling tools such as cron, launchd, and systemd to ensure the monitoring script (mechanical layer) runs periodically. While this is the intended functional purpose of the skill, it utilizes persistence mechanisms to maintain the monitoring loop (references/pattern-mechanical-brain.md).

duoduo-pipeline