The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the local project environment and interpolates it into persistent memory files used by the AI agent.
Ingestion points: The skill reads manifest files (package.json, pyproject.toml, Cargo.toml, go.mod, pom.xml), project layout, and the last 10 lines of git log.
Boundary markers: The skill uses  and  tokens to mark the generated section, but it does not include instructions for the agent to ignore potentially malicious commands embedded within that section.
Capability inventory: The skill can execute shell commands via npx and has write access to repository root files like CLAUDE.md and AGENTS.md.
Sanitization: The instructions explicitly state to "Record each command verbatim with its source," which means any malicious code or instructions found in manifests or commit logs will be written directly into the agent's context without filtering.
[EXTERNAL_DOWNLOADS]: The skill uses npx to download and run a package at runtime.
Evidence: The skill calls npx -y pocketto-pi edu and npx -y pocketto-pi edu init during the education onboarding step.
Package: pocketto-pi is fetched from the npm registry.
[COMMAND_EXECUTION]: The skill executes local shell commands to gather project metadata and manage learner profiles.
Evidence: Uses git log --oneline -10 to determine project conventions and multiple npx calls for tool execution.

pocket-init