The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest "observations" from local Markdown files and instructs the agent to "apply its OPEN observations to the work." This creates an attack surface where instructions stored in data files can influence or override agent behavior if the log directory is tampered with.
Ingestion points: The agent reads from Markdown files in the observation-log/ directory via the observe.sh scan command during session startup.
Boundary markers: There are no specific delimiters or instructions to ignore embedded malicious content within the log files.
Capability inventory: The skill possesses capabilities for reading and writing to the filesystem and executing shell commands via its helper scripts.
Sanitization: The skill does not perform validation or sanitization of the observation content before loading it into the agent's context.
[COMMAND_EXECUTION]: The skill relies on executing local helper scripts to manage its state and workspace.
Dispatcher Script: scripts/observe_hook.py uses subprocess.run to execute the shell or PowerShell helpers.
PowerShell Execution: scripts/observe.ps1 is explicitly invoked with -ExecutionPolicy Bypass to allow the script to run on restricted systems.
Shell Utilities: scripts/observe.sh uses various standard utilities such as find, awk, and sed to search for skill directories and parse file headers across the filesystem.

task-observer