The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to capture user-provided descriptions of cross-project connections and store them exactly as provided ('The user's words, unchanged') into YAML files within the bridges directory. This raw input is then read back by the agent during list, map, and statistics operations. An attacker could provide a description containing malicious instructions that would be persisted and later processed by the agent, potentially influencing its behavior in subsequent sessions.
Ingestion points: User-provided <desc> argument in the /bridge command (SKILL.md).
Boundary markers: The skill uses YAML double-quoting and escaping of double-quotes to prevent syntax breakage, but lacks natural language sanitization or instruction-ignoring delimiters (references/storage-and-schema.md).
Capability inventory: The skill uses Read, Write, Bash, Glob, and Edit tools to manage the bridge files.
Sanitization: Only syntax-level escaping for YAML compliance is performed; there is no validation of the content against malicious instructions.
[COMMAND_EXECUTION]: The skill instructions direct the agent to execute specific Bash command pipelines to calculate file sequence numbers and validate YAML integrity using external tools like sed and yq.
Evidence: last="$(ls "$dir" | sed -n "s/^$(date +%F)-$[0-9]*$-.*/\1/p" | sort -n | tail -1)"; seq=$(( ${last:-0} + 1 )) (SKILL.md, references/storage-and-schema.md).
Evidence: yq '.' ./thinking/bridges/"$file" > /dev/null (SKILL.md, references/storage-and-schema.md).

bridge