The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. It ingests untrusted data from .aris/meta/events.jsonl, which includes raw user prompts and tool inputs. This data is then passed to an external LLM (gpt-5.4) to generate system-level modifications (patches for SKILL.md files). An attacker who can influence the logs could potentially trick the optimizer into proposing malicious changes.
Ingestion points: .aris/meta/events.jsonl via Step 1 and Step 4.
Boundary markers: None identified in the prompt sent to the reviewer LLM.
Capability inventory: The skill has Write, Edit, and Bash permissions to apply changes to the file system.
Sanitization: No validation or sanitization of the log content is performed before processing.
[COMMAND_EXECUTION]: The skill uses Bash to perform file operations, count events, and validate data availability within the .aris/meta/ directory. While these are currently limited to log processing, the capability allows for arbitrary shell execution.
[DATA_EXFILTRATION]: The skill reads .aris/meta/events.jsonl, which contains detailed session metadata, user prompts, and tool execution summaries. This sensitive usage data is then sent to an external model provider via the mcp__codex__codex tool for analysis and patch generation.

aris-meta-optimize