The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill allows the agent to modify project-level instruction files (CLAUDE.md) and configuration files (.beta/config.toon) that dictate behavior. If these files are compromised or injected with malicious instructions, the agent may follow them during subsequent interactions.
Ingestion points: The skill reads content from .beta/config.toon, prompts/system/persona-template.toon, CLAUDE.md, and an SQLite database to display or edit settings.
Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions when interpolating the contents of these files into the agent's context.
Capability inventory: The skill is granted write_file, read_file, run_code, and list_dir tools, allowing it to modify the file system and potentially execute code based on the configurations.
Sanitization: While the skill mentions validation against 'Zod schemas', this typically ensures data structure and type safety rather than preventing malicious natural language instructions hidden in persona or behavior rule fields.

customize