The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by instructing the agent to read, synthesize, and rewrite local files such as .bon/understanding.md and content from the .bon/contributions/ directory.
Ingestion points: .bon/understanding.md and .bon/contributions/* are ingested into the agent's context during the 'Session Start Ritual'.
Boundary markers: Absent; the instructions do not specify the use of delimiters or 'ignore' instructions to isolate the content of these files from the agent's primary instructions.
Capability inventory: The skill utilizes Edit, Write, and Bash(bon:*) tools, which could be misused if the agent obeys instructions embedded within the processed data.
Sanitization: No explicit sanitization, validation, or escaping of external file content is described before the data is rewritten or integrated into the project's 'understanding' document.

open