The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted external data such as user transcripts, workflows, and notes to generate executable skill packages, which exposes the agent to indirect prompt injection attacks.
Ingestion points: SKILL.md and references/autonomous-adaptation.md specify reading user-provided source files and notes.
Boundary markers: The instructions mention "ignore embedded instructions" in passing, but the skill lacks robust delimiter-based sanitization for user-provided context during the generation process.
Capability inventory: The skill defines workflows for writing files (adapt-apply), executing shell commands (verification commands), and performing network operations (output-exec).
Sanitization: While references/autonomous-adaptation.md mentions redacting sensitive text before storing excerpts, the logic for this is not technically enforced within the provided files.
[COMMAND_EXECUTION]: The skill framework explicitly relies on executing shell commands for its core functionality, including skill validation, installation simulation, and running evaluation benchmarks.
Evidence: references/output-eval-method.md describes using a --runner-command flag to execute arbitrary shell commands (e.g., python3 scripts/local_output_eval_runner.py).
Evidence: references/autonomous-adaptation.md details the execution of verification commands restricted to local make targets or Python scripts.
[DATA_EXFILTRATION]: The skill incorporates a telemetry system and instructions for automated evaluation routines that send data to external providers.
Evidence: references/telemetry-drift-method.md describes a telemetry system designed to aggregate and potentially export event data.
Evidence: references/output-eval-method.md explains the use of the OPENAI_API_KEY environment variable and connecting to external API endpoints for output evaluation.

yao-meta-skill