The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/mailbox.sh takes user-controlled arguments via $ARGUMENTS in SKILL.md and passes them directly to a bash script. While it uses "$*" for content, which prevents some word-splitting issues, the load and read commands output file content directly to the console where an agent will process it.
[DATA_EXFILTRATION]: The skill is designed to store agent findings and 'standing orders' persistently in the ψ/memory/mailbox/ directory. While this is the intended functionality, it creates a repository of agent context and potentially sensitive task findings that could be read by any subsequent agent session.
[INDIRECT_PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection.
Ingestion points: Reads files from ψ/memory/mailbox/ (e.g., standing-orders.md, *_findings.md) and outputs them into the agent's current prompt context.
Boundary markers: Missing. Content is output with headers like ## Previous Context but without strong 'ignore embedded instructions' warnings for the processing agent.
Capability inventory: The skill allows arbitrary file writes (write, orders) and reads within its storage directory. The agent processing the 'loaded' context has full CLI capabilities.
Sanitization: None. The content is written to and read from markdown files exactly as provided.
[PERSISTENCE]: While legitimate for the use case, the skill explicitly implements a persistence mechanism to preserve instructions and 'standing orders' across agent sessions, effectively creating a persistent state that bypasses the ephemeral nature of standard agent sessions.

mailbox