The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill dynamically constructs and executes paths to Python Zip Applications (pyz) based on workflow phases. As described in references/delta-contract.md, each phase is expected to run its own resolver script using the pattern python3 skills/<phase>/scripts/<phase>.pyz. This dynamic loading from computed paths poses a risk if phase identifiers can be manipulated.
[COMMAND_EXECUTION]: The skill relies on shell command execution for its core functionality and environment inspection.
It executes python3 to run the wheypoint.pyz archive for tasks like checkpoint, validate, resolve, and turns analysis.
It uses Git commands, including git status, git rev-parse, and git log, to gather repository-level metadata for session provenance.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data from multiple sources, creating a surface for indirect prompt injection attacks.
Ingestion points: The skill reads user conversation history via the turns command and external handoff files via the resolve command (found in .cheese/notes/*.md).
Boundary markers: The skill employs JSON schema validation for intents and includes a mechanism to detect and refuse text matching credential patterns.
Capability inventory: The skill can write Markdown projections to the file system, execute shell scripts, and perform Git operations across the repository.
Sanitization: While it validates structure and checks for hardcoded credentials, it does not explicitly sanitize free-text notes or conversation turns against adversarial instructions that could influence subsequent agent behavior.

wheypoint