The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input across six phases (e.g., identity, purpose, relationship, and access tiers) and renders this data verbatim into system files like SOUL.md and ACCESS_POLICY.md. These files guide the agent's core personality and security constraints.
Ingestion points: User responses are captured via gbrain bootstrap interview --set in SKILL.md.
Boundary markers: The instructions mandate recording answers "verbatim" without explicit delimiters or sanitization mentioned, potentially allowing injected instructions to persist in the agent's identity files.
Capability inventory: The agent can execute shell commands via the gbrain CLI, which is used to modify the environment and system files.
Sanitization: No sanitization or filtering logic is specified for the captured strings.
[COMMAND_EXECUTION]: The skill relies on the shell tool to perform all operations, specifically invoking the gbrain CLI for state management and file rendering. While these are purposeful for the skill's function, the execution of shell commands with user-provided arguments requires the underlying CLI to handle input safely.

soul-audit