The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted note content, titles, and tags. While the documentation explicitly instructs the agent to treat this data as untrusted and never execute instructions found inside notes, this constitutes an indirect prompt injection surface.
Ingestion points: dino note get, dino note preview, dino note detail, and dino note search all ingest potentially attacker-controlled markdown content into the agent context.
Boundary markers: The skill mentions that structured output (--format json) should be preferred for downstream parsing, which provides some schema isolation, but does not provide explicit prompt delimiters for the note content itself.
Capability inventory: The skill has access to the Bash tool, allowing it to execute dino CLI commands, write to /tmp/, and potentially perform network operations via dino storage upload.
Sanitization: No specific sanitization or filtering of markdown content is mentioned beyond instructions to the LLM to ignore embedded commands.

dino-note