The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to download and install the polis-protocol package from PyPI using tools like uvx or pipx. This package and its source repository are not associated with a trusted organization or well-known vendor.
[COMMAND_EXECUTION]: The instructions in SKILL.md and POLIS_CONSTITUTION.md direct the agent to execute shell commands, including package managers and local Python scripts (scripts/init_polis.py, scripts/route_contract.py), to initialize and maintain the protocol.
[DYNAMIC_EXECUTION]: The scripts/init_polis.py script programmatically writes a SKILL.md file to a hidden directory (.agents/skills/polis-protocol/). This replicates the skill's own instructions into the project workspace, which may be automatically loaded by other agents or future sessions.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from shared project files which could be modified by other agents or users.
Ingestion points: _polis/chronicle.md, _polis/citizens/*/inbox.md, and various contract files within _polis/contracts/.
Boundary markers: The protocol relies on standard Markdown and YAML fences but lacks specific instructions to ignore embedded commands or malicious instructions within these shared buffers.
Capability inventory: The skill allows for filesystem writes, shell command execution via provided scripts, and autonomous task routing based on the content of these files.
Sanitization: There is no evidence of sanitization or strict validation of the natural language content read from the shared markdown files before it is provided to the agent's context.

polis-protocol-a-self-optimizing-city-of-agents