The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data by reading workspace files via the file_paths parameter in send_notification. While there are no complex interpolation logic or unsafe execution patterns, the skill serves as a delivery mechanism for potentially malicious content (e.g., instructions embedded in markdown or source code) to be sent to a user's mobile device via Signal.
Ingestion points: file_paths argument in handler.ts (resolves relative workspace paths).
Boundary markers: None. The skill assumes the user wants the content of the files as-is.
Capability inventory: File system read (existsSync, path.resolve), Database write (prisma.notification.create).
Sanitization: Implements path resolution and workspace boundary checks to prevent path traversal.
[COMMAND_EXECUTION]: The handler performs file system operations and database interactions based on user-provided arguments.
Evidence: handler.ts uses path.resolve(WORKSPACE_ROOT, cleaned) and existsSync(absPath) to validate files before queuing them for delivery. It also uses prisma to persist notification data. These are standard operations for the skill's purpose and are guarded against directory traversal.

notifications