The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a platform-provided binary helix for session management operations (up, push, wait, rails). It also uses curl to interact with a local API endpoint on 127.0.0.1 and kill to manage its own server process by PID.
[DATA_EXPOSURE]: The skill accesses application-specific state and configuration files located in the ~/.helix/spark/ directory. This is used for session persistence and process management.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data which constitutes an attack surface for indirect prompt injection.
Ingestion points: Untrusted data enters the context via user chat messages (chat.added), verdicts (response.added), and board updates (card.updated), as well as the reading of external codebase files during ideation.
Boundary markers: Behavioral boundaries are enforced through a specialized rails system (helix rails for --surface spark).
Capability inventory: Shell execution is limited to the helix binary via frontmatter restrictions, along with local API access via curl and process management via kill.
Sanitization: The skill instructions mandate the use of shell heredocs (<<'EOF') when pushing payloads to prevent command injection.
[PROMPT_INJECTION]: The skill contains strong directives to the agent, such as a "Hard rule" forbidding file writes and instructions that behavior is "ratified." These are functional safety constraints designed to keep the agent within its intended scope rather than malicious bypass attempts.

spark