The Agent Skills Directory

[PROMPT_INJECTION]: Indirect prompt injection surface. The skill writes user-supplied fragments to the .codestable/attention.md file, which is explicitly described as 'mandatory context' that the agent must read at the start of every session. Malicious input could be used to persist instructions that override agent behavior in future interactions.
Ingestion points: The agent reads .codestable/attention.md during the initialization flow described in the '启动必读' (Startup) and '流程' (Process) sections.
Boundary markers: The skill uses a specific HTML comment  and fixed markdown headers to organize and delimit the content it manages.
Capability inventory: The skill performs file read, write, and search (grep) operations on the local file system within the .codestable/ directory.
Sanitization: No explicit sanitization, filtering, or escaping of the user-provided snippets is mentioned before appending them to the context file.
[COMMAND_EXECUTION]: File system interaction. The skill executes operations to read, create, and append data to files in the local workspace. While these operations are directed at the .codestable/ configuration directory, they are used to modify the persistent instructions followed by the AI agent.

cs-note