The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to read and process raw, messy exports from sessions and tweets. It lacks explicit instructions to treat this content as data only or boundary markers to prevent the agent from following instructions embedded in the raw items. A maliciously crafted session or tweet could attempt to hijack the agent's reasoning during the distillation process.
Ingestion points: The skill reads from sessions/inbox/*.md, tweets/inbox/*.md, and direct user pastes.
Boundary markers: No delimiters or "ignore embedded instructions" warnings are used when the agent reads the raw content.
Capability inventory: The skill has the ability to write new files to the filesystem (domains/<domain>/notes/) and execute shell commands (make index, python scripts/build_index.py, python scripts/embed.py).
Sanitization: There are no instructions for sanitizing or filtering the content before it is processed or stored.
[COMMAND_EXECUTION]: The procedure requires the agent to execute shell commands (make index and Python scripts) to re-index the knowledge base. While these are local scripts within the repository, they are executed immediately after processing untrusted input, which is a common pattern in exploitation chains.

distill-session