The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted source documents (markdown, PDF, etc.) from the kb/raw/sources/ directory, which represents an indirect injection surface. The skill robustly mitigates this through the following mandatory evidence chain: 1. Ingestion points: Reads external files placed in kb/raw/sources/. 2. Boundary markers: Strictly uses blockquotes for verbatim source text with mandatory attribution; Rule 1 in SKILL.md explicitly instructs the agent to treat sources as data, not directives. 3. Capability inventory: Executes local maintenance scripts (lint.ts, map.ts), performs file writes to the wiki directory, and makes authenticated network calls to the Anthropic API. 4. Sanitization: All project-derived values, specifically category names, are validated against a strict allowlist (^[a-z][a-z0-9-]*$) before being used in shell commands.
[REMOTE_CODE_EXECUTION]: Automated scans detected a remote code execution pattern (curl | sh). This is a false positive because the code snippet is contained within a string literal in scripts/lint.test.ts, used specifically to test the skill's own internal security scanner.
[PROMPT_INJECTION]: Scanners flagged 'ignore instructions' patterns in SKILL.md. This is a false positive; the text is part of a security rule that instructs the agent to ignore and quarantine any injection attempts found within ingested source documents.
[COMMAND_EXECUTION]: The skill executes local scripts (lint.ts, map.ts) for wiki maintenance. These operations are limited to the skill's own code and do not execute arbitrary commands. Shell arguments are properly quoted, and directory names are allowlist-validated to prevent command injection.

kb-wiki