The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the agent to execute local Python scripts (context_snapshot.py and an external context_manager.py) to save and restore context state. While these are part of the skill's core functionality, they represent a capability for local code execution based on prompt instructions.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and summarize the entire conversation history into persistent snapshots. This creates a surface for indirect prompt injection where malicious instructions from external sources (e.g., contents of a web page read by the agent) could be stored in a snapshot and later re-executed as 'trusted' context during restoration.\n
Ingestion points: The agent is instructed to traverse the full conversation history in SKILL.md (Fase 1: Extracao Estruturada).\n
Boundary markers: The skill includes a specific warning that snapshots are data and not reliable instructions, though it lacks strict technical isolation for the ingested content.\n
Capability inventory: The agent uses file-writing tools and the provided Python script to persist data.\n
Sanitization: The instructions include a manual sanitization step for the agent to remove secrets and personal data.\n- [DATA_EXPOSURE]: The documentation and metadata expose specific local file paths and environment details belonging to the author (C:\Users\renat\...), which leaks system configuration information and could lead to errors if executed in different environments.\n- [SAFE]: The Python script scripts/context_snapshot.py implements proactive security measures, such as using O_NOFOLLOW flags and stat.S_ISREG checks to mitigate symlink attacks and path traversal when reading or writing snapshots.

context-guardian