The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill enables the agent to retrieve previously shelved artifacts (such as design documents or reports) using the shelf get command. Because these artifacts are external data sources, they could contain malicious instructions intended to manipulate the agent's behavior once loaded into the context.
Ingestion points: Data enters the agent's context when executing ${CLAUDE_PLUGIN_ROOT}/bin/helix shelf get <id> or shelf find.
Capability inventory: The skill interacts with the local file system (reading and writing to ~/.helix/shelf) and can perform network operations for bookmarking via the helix CLI.
Boundary markers: While artifacts are metadata-wrapped, there are no instructions to the agent to treat the content of shelved files as untrusted or to ignore embedded instructions.
Sanitization: The instructions do not specify any validation, filtering, or sanitization of the artifact content before it is processed by the agent.
[COMMAND_EXECUTION]: The skill is designed to interact with a specific vendor CLI tool (helix) located in the plugin's binary directory. The execution is scoped to this tool via frontmatter restrictions, which is a standard security practice to limit the agent's environment.

shelf