The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from previously stored filesystem snapshots and database records which could be exploited to inject malicious instructions during the analysis phase.
Ingestion points: Reads data from the .beta/snapshots/ directory and the snapshots table in the local SQLite database.
Boundary markers: The instructions for "Interactive Mode" and "Show diff" lack explicit delimiters or warnings to ignore embedded instructions within the displayed content.
Capability inventory: The skill uses run_code for database interactions, along with write_file and read_file for restoration operations.
Sanitization: While integrity checks (SHA-256) are performed during restoration, there is no validation or sanitization of snapshot descriptions or file contents before they are interpreted by the agent.
[METADATA_POISONING]: A discrepancy exists between the author name specified in the skill metadata and the developer context provided.
Evidence: The YAML frontmatter identifies the author as betaclaw, which does not match the expected author rawknee-69 associated with the submission.

rollback