The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function involves parsing session transcripts to extract state and merge it into long-term persistent storage (CONTEXT.md). This ingestion of untrusted conversational data presents a surface for indirect prompt injection attacks.
Ingestion points: The skill reads session transcripts in JSONL or JSON format from Claude Code, GitHub Copilot, or opencode via the scripts located in the hooks/ directory.
Boundary markers: The skill uses a rigid Agent State schema and specific markdown headers (e.g., ## Approved Workflow, ## Decision Log) to delimit and categorize extracted content.
Capability inventory: The skill possesses the ability to write to the local filesystem (CONTEXT.md, .duck-tape/ directory) and execute bundled shell scripts.
Sanitization: Mitigations include regex-based redaction of secrets/PII in all extraction scripts and a 'durable-context filter' designed to strip session-specific narration and retain only durable decisions and facts.
[COMMAND_EXECUTION]: The skill provides and executes local bash and PowerShell scripts to automate the extraction of session state from transcripts. These scripts are intended to be invoked by harness-specific hooks.
Evidence: hooks/extract-state.sh, hooks/extract-state.ps1, hooks/extract-raw.sh, and hooks/extract-raw.ps1.
Mitigation: The scripts include path hardening measures such as symlink rejection, canonical path verification, and optional root-boundary enforcement (via DUCK_TAPE_TRUSTED_ROOT) to prevent unauthorized file access.
[SAFE]: The skill exhibits several security-conscious design patterns:
Redaction: Proactively scans for and masks potential secrets (API keys, tokens, credentials) before writing any data to persistent or working storage.
Approval Workflow: Implements a strict, phase-based execution approval process for all semantic changes to the workspace, ensuring the user remains in control of file modifications.
Integrity Checks: Implements file size limits (configurable via DUCK_TAPE_MAX_TRANSCRIPT_BYTES) and validates transcript formats before processing.

duck-tape