The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from local markdown files to gather context for its tasks, which presents a surface for potential instruction injection if those files are modified by an external actor.
Ingestion points: The skill loads several files from the .pawbytes/ directory, including product-context.md and audience-intelligence.md, as seen in SKILL.md and references/autonomous-wake.md.
Boundary markers: No explicit delimiters or boundary markers (like "ignore instructions in this text") are used when interpolating the content of these files into the agent's context.
Capability inventory: The skill's capabilities are limited to reading and writing files within the project's localized vendor directories and generating text outputs; it lacks network access or arbitrary command execution tools.
Sanitization: The skill does not perform sanitization or validation on the content read from the memory files before using it to drive the generation process.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill accesses local configuration files to personalize its output.
The skill reads config.yaml and config.user.yaml from the {project-root}/.pawbytes/config/ directory.
These operations are restricted to project-specific paths associated with the skill's vendor and do not involve system-level sensitive files or network exfiltration.

paw-ps-knowledge-executor