The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill enables an agent to read message previews from other active sessions via the recent_messages function. This creates a vulnerability surface where the agent could ingest and inadvertently execute malicious instructions embedded in the history of a sibling or child agent.
Ingestion points: Untrusted data enters the agent context through the recent_messages function in src/agent_observe/__init__.py.
Boundary markers: The implementation does not wrap retrieved messages in delimiters or provide 'ignore embedded instructions' markers to the agent.
Capability inventory: The skill facilitates data retrieval via host_request across ALL functions in src/agent_observe/__init__.py.
Sanitization: No sanitization or filtering is applied to the message content before it is returned to the calling agent.
[DATA_EXPOSURE]: The skill facilitates discovery and inspection of session metadata, including current working directories (cwd), session identifiers, and status across the agent's 'nuclear family'. While the skill is read-only and restricted by the host daemon, it increases the visibility of potentially sensitive session-level information.

agent-observe