The Agent Skills Directory

[METADATA_POISONING]: The skill metadata identifies the author as "system". This is deceptive as it implies the skill is a built-in or native extension of the platform rather than a third-party contribution, potentially leading to misplaced trust by the user.
[INDIRECT_PROMPT_INJECTION]: The skill provides an attack surface where instructions embedded in data could influence the agent's behavior during later sessions.
Ingestion points: The log_habit tool in handler.ts accepts and stores free-form user input for the activity, location, and notes fields in an SQLite database.
Boundary markers: When the habit data is retrieved via query_habits or habit_stats, the output is formatted as a markdown list but lacks explicit delimiters or instructions telling the agent to ignore any command-like text within the entries.
Capability inventory: The skill has database write and delete capabilities via Prisma (prisma.habitEntry.create, prisma.habitEntry.delete). It does not have network access or file system permissions.
Sanitization: The normalizeActivity function in handler.ts performs basic string cleaning (trimming and stripping verbs), but there is no filtering or sanitization of natural language instructions that might be contained in the stored data.

habit-tracker