The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through its ingestion of external configuration files.
Ingestion points: It reads instructions from the target repository's agent-instructions file and preference data from preferences.md (referenced in SKILL.md).
Boundary markers: There are no documented delimiters or instructions to ignore embedded commands within these external files in SKILL.md.
Capability inventory: The agent can perform git operations (clone, push) and write to local filesystem artifacts like design documents or specifications (SKILL.md).
Sanitization: The skill lacks explicit sanitization or validation of the content retrieved from external files.
[COMMAND_EXECUTION]: The skill performs shell-level operations to manage decision memory.
Evidence: Instructions include performing a shallow-clone of the target repository at session start and a push of session records as a Pull Request at session end (SKILL.md).
[EXTERNAL_DOWNLOADS]: The skill fetches data from an external repository provided by the user.
Evidence: The skill is instructed to clone the repository specified in the DECISION_MEMORY_URL environment variable (SKILL.md).

grilling