The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill contains a 'Self-Evolving Skill' policy and a 'Post-Execution Reflection' workflow that explicitly commands the agent to rewrite its own instruction file (SKILL.md). This self-modification pattern allows for the persistence of unintended or malicious instructions if the agent's logic is influenced during runtime.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection because it processes content from external files without sanitization.
Ingestion points: In SKILL.md (Step 1), the command chezmoi diff --no-pager reads the contents of locally modified dotfiles directly into the agent's context.
Boundary markers: The instructions lack specific boundary markers or 'ignore' directives to prevent the agent from interpreting instructions contained within the dotfile contents or diff output.
Capability inventory: The skill is granted Bash and Edit tools. These allow it to execute system commands and modify files, including its own source instructions.
Sanitization: There is no evidence of filtering or validation for the data returned by the chezmoi tool before the agent acts upon it.
[COMMAND_EXECUTION]: The skill uses the Bash tool to perform sensitive operations including chezmoi re-add and git operations (git commit, git push). While these are standard for dotfile management, they provide a mechanism for data exfiltration to remote repositories if the agent is manipulated into performing unintended syncs.

chezmoi-sync