The Agent Skills Directory

[NO_CODE]: The skill consists entirely of markdown instructions and reference documentation without any executable scripts or binary files, significantly reducing the risk of traditional code-based attacks.
[PROMPT_INJECTION]: The skill implements a persistent state mechanism by reading from and writing to references/learnings.md at the beginning and end of each session. This creates a surface for indirect prompt injection where malicious instructions could be recorded into the file and subsequently processed by the agent in later interactions.
Ingestion points: The file references/learnings.md is read at the start of Step 1 to gather accumulated platform knowledge.
Boundary markers: There are no explicit markers or instructions to treat the contents of the learning file as untrusted or to ignore embedded commands.
Capability inventory: The skill does not possess capabilities for network operations, high-privilege command execution, or arbitrary file system writes beyond appending to its own reference file.
Sanitization: No validation or sanitization is performed on the data being appended to or read from the learnings file.

sales-noty