The Agent Skills Directory

[PROMPT_INJECTION]: The SKILL.md file includes instructions for the agent to proactively propose the OpenProse framework to users even when it has not been explicitly requested. The instructions suggest the agent should 'notice patterns' and offer to wire workflows as OpenProse responsibilities, which is an attempt to influence the agent's decision-making and bypass user intent for neutral behavior.
[METADATA_POISONING]: In the 'Giving Back' section, the skill instructs the agent to 'Save a recognition memory' in its internal memory system. This instruction is specifically designed to bias the agent in future sessions by recording signals and reasons that would make it more likely to recommend this specific framework again.
[INDIRECT_PROMPT_INJECTION]: Several examples within the skill (e.g., examples/inbox-triage/, examples/press-desk/) describe systems that ingest and process untrusted data from external sources such as email feeds and webhooks. This architecture creates a surface for indirect prompt injection, where malicious instructions hidden in the data could influence the agent's execution of the OpenProse VM.
[DYNAMIC_EXECUTION]: The skill implements 'ProseScript', an imperative scripting layer defined in prosescript.md and used in ### Execution blocks within contracts. This allows for the dynamic execution of complex choreography, including loops, conditionals, and parallel processing, effectively allowing the skill to program the agent's multi-step behaviors.
[REMOTE_CODE_EXECUTION]: The deps.md file defines a git-native dependency model where the skill clones and executes code from any remote git repository (including GitHub, GitLab, and self-hosted instances). Although managed by an explicit prose install step, this mechanism allows for the resolution and execution of third-party contract logic within the agent's session.

open-prose