The Agent Skills Directory

[PERSISTENCE]: The skill instructions direct the agent to maintain its own activity and state monitoring across idle periods by scheduling recurring checks.\n
Evidence: In SKILL.md, the agent is instructed: 'A session that goes idle with items waiting schedules its own check (a cron or a loop, where the harness has one) rather than waiting for the next message.'\n
Risk: Automated scheduling of execution loops allows the agent to persist across session boundaries and perform logic without active user oversight or direct prompts.\n- [INDIRECT_PROMPT_INJECTION]: The skill establishes a vulnerability surface by instructing the agent to ingest and act upon data provided via an external database or the OWNER.md file.\n
Ingestion points: The agent is instructed to read from OWNER.md or a database answers collection via the platform's Artifact database tool (window.claude.use("db")) in references/owner-page.md.\n
Boundary markers: The skill defines 'gates' for high-risk actions (one-way doors) that require specific confirmation in the primary chat, and instructs the agent to 'reconcile' state with reality. However, many tasks and decisions are processed based on the external input without additional boundaries.\n
Capability inventory: The agent possesses capabilities for file system operations (STATUS.md, LOG.md), monitoring system processes (PIDs), and executing the primary tasks associated with the session context.\n
Sanitization: No explicit sanitization or validation of the 'answers' content is required before the agent 'acts' on them, creating a risk that malicious instructions embedded in the owner page data could influence agent behavior.\n
Remediation: To mitigate this risk, external input should be treated as untrusted data and wrapped in clear delimiters with instructions to ignore embedded commands. All high-privilege actions resulting from these inputs should require a human-in-the-loop checkpoint.

flight-deck