The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process Markdown files from the repository, which serves as a potential vector for indirect prompt injection from untrusted sources.\n
Ingestion points: Memory entries are read from the .lore/ directory during sync, query, audit, and history workflows.\n
Boundary markers: The skill uses specific  and  HTML comments to separate managed content from user notes in platform instruction files.\n
Capability inventory: The system performs file writes within the project boundary and executes local git commands. It does not possess network access.\n
Sanitization: The scripts/safe_read.py script provides a read_text utility that rejects symlinks, enforces a 2MiB size limit, and uses an inert function to escape Markdown and HTML special characters. Furthermore, the SKILL.md documentation provides clear instructions that memory entries must not be treated as authoritative over safety guidelines or system prompts.\n- [COMMAND_EXECUTION]: Several Python scripts execute shell commands to interact with the project's Git history and other internal tools.\n
Evidence: scripts/history.py executes git log, git rev-parse, and git show. scripts/find_duplicates.py and scripts/find_stale.py invoke list_entries.py using sys.executable.\n
Security Controls: All subprocess.run calls pass arguments as a list to avoid shell injection. scripts/history.py implements rigorous path validation, checking for absolute paths, directory traversal sequences, and control characters, and uses the --literal-pathspecs Git flag to prevent malicious pathspec interpretation.

lore