The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill includes an update mechanism that ingests external content from 'clippings' and other user-provided files to modify the principles.md file. This creates an attack surface where malicious instructions embedded in that external data could potentially influence the agent's future behavior or inventory management.
Ingestion points: Section 5 ('Update') in SKILL.md identifies external clippings and files pointed at by the user as data sources.
Boundary markers: The instructions do not define specific delimiters or directives to ignore instructions within the ingested clippings.
Capability inventory: The skill maintains read and write capabilities for ~/Documents/Cowork Root/MEMORY.md and principles.md as part of its core functionality.
Sanitization: There is no automated sanitization or filtering mentioned for the input content; however, the skill implements a human-in-the-loop safety check by requiring user acceptance of a diff before writing changes.

ask-cal