The Agent Skills Directory

[PROMPT_INJECTION]: The skill uses the pattern ARGUMENTS: $ARGUMENTS at the end of its instruction set. This directly interpolates user-provided text into the agent's context, allowing a user to potentially override the skill's logic or safety guidelines by providing malicious instructions as arguments.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources including Git logs, GitHub issues, and session files. While many steps use statistics (e.g., counting commits), the diagnostic logic for 'Burnout' and 'Breakthrough' signals suggests the agent will evaluate the semantic content of these sources. This creates a surface where an attacker could place malicious instructions in commit messages or issue titles to influence the agent.
Ingestion points: git log output, gh issue list output, and Claude session files located in ~/.claude/projects/.
Boundary markers: Absent. There are no delimiters or instructions to ignore embedded commands within the gathered evidence.
Capability inventory: Shell execution (git, gh, ls, date, wc, jq) and file writing (ψ/memory/logs/feels.log).
Sanitization: Minimal. While some data is piped through wc or jq, the final qualitative analysis of 'signals' lacks sanitization for NL instructions.
[COMMAND_EXECUTION]: The skill executes multiple shell commands to gather project metadata. These include git log, gh issue list, and ls on sensitive paths like ~/.claude/projects/. These commands are used for their intended purpose of activity monitoring, but they provide the skill with broad visibility into the user's workspace.

feel