The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts scripts/data.py and scripts/room_rules.py utilize the subprocess module to execute the system text editor specified by the $EDITOR environment variable. This allows users to manually edit local configuration and rule files. This is a common and intended design for CLI-based agent tools.
[EXTERNAL_DOWNLOADS]: scripts/self_update.py connects to the internal sc-chatroom server to download skill bundle updates in tarball format. This process incorporates SHA256 integrity verification for all downloaded assets before extraction to ensure that only authorized updates from the vendor are applied.
[INDIRECT_PROMPT_INJECTION]: Because the skill processes real-time group chat messages, it is naturally susceptible to indirect prompt injection from chat participants. The skill addresses this by injecting a specialized behavior block into the agent's SOUL.md, providing explicit instructions on following server-side constraints and using [SILENT] markers to prevent the agent from being manipulated by chat content.
[DYNAMIC_EXECUTION]: The scripts/self_update.py script performs atomic updates of the skill's own source code by downloading and extracting tarballs. The extraction logic includes path validation to prevent directory traversal attacks, and the update source is limited to the trusted internal server environment.

workroom