The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data in the form of JSON output from the gbrain advisor command. This JSON contains fix.command_argv and fix.dispatch_id fields which the agent is instructed to use for command execution. If the output of the CLI tool were to be manipulated by an attacker, it could influence the agent to suggest or execute unauthorized commands.
Ingestion points: SKILL.md (How to run it section) defines the ingestion of gbrain advisor --json output.
Boundary markers: The instructions explicitly require the agent to 'SHOW the user the findings and ASK before running any fix', which acts as a human-in-the-loop boundary.
Capability inventory: The skill allows for the execution of the gbrain CLI with various arguments, including an --apply flag for specific dispatch IDs or running arbitrary fix.command_argv values provided in the JSON.
Sanitization: There is no technical sanitization of the JSON payload; the skill relies entirely on the user's manual review of the proposed command before execution.
[COMMAND_EXECUTION]: The skill is designed to execute local shell commands (gbrain advisor --json, gbrain advisor --apply <dispatch_id>, and other generated fix.command_argv). While these are intended for system maintenance, they represent a capability to mutate the local environment.
[PERSISTENCE]: The skill includes a 'Cron recipe' providing instructions for setting up a weekly checkup via a scheduler. This is a documented, user-visible feature for the skill's primary purpose and does not represent a hidden or malicious persistence mechanism.

gbrain-advisor