The Agent Skills Directory

[PROMPT_INJECTION]: Indirect Prompt Injection surface via repo-level markdown file. The skill reads and renders the content of docs/compass.md to the agent. If an attacker with repository access modifies this file, they could embed instructions that manipulate the agent's behavior during a session.
Ingestion points: The read and read --compact subcommands ingest content from docs/compass.md (SKILL.md).
Boundary markers: No explicit delimiters or instructions are provided to the agent to treat the file content as data rather than instructions.
Capability inventory: The skill executes local Python scripts and interacts with Git and the GitHub CLI (gh).
Sanitization: No sanitization or validation of the markdown content is mentioned before it is displayed to the agent.
[COMMAND_EXECUTION]: Local script and CLI tool invocation. The skill is designed to execute a local Python script scripts/compass.py and standard development tools such as git and gh (GitHub CLI) for state management and workflow integration. These are used as intended for the skill's utility purpose.

compass