The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute ledger CLI commands for task management, such as ledger definition check, ledger transact, and ledger project. These commands interact with a local repository and storage files.
[COMMAND_EXECUTION]: The tests/test_protocol.py file uses subprocess.run to execute a bootstrap script via bash and subsequently run the ledger binary. The bootstrap script path is determined relative to the skill's location (../ledger/scripts/ensure-ledger).
[INDIRECT_PROMPT_INJECTION]: The skill ingests user-supplied task titles and IDs, which are stored and processed within the Ledger task graph. This creates a surface for indirect prompt injection where malicious instructions could be embedded in task data.
Ingestion points: Task titles and identifiers are ingested through submission and dependency JSON inputs provided to the ledger transact command, as described in SKILL.md and definitions/ledger/task-protocol.json.
Boundary markers: The protocol definition in task-protocol.json uses JSON schema validation to enforce structural constraints on inputs.
Capability inventory: The skill possesses the capability to execute shell commands via the ledger CLI and run a Python test suite that invokes subprocesses.
Sanitization: Input sanitization is implemented through length limits (512 bytes for titles, 128 bytes for IDs) and the requirement for identifiers to match a safe_identifier regex pattern, reducing the risk of certain injection attacks.

ergon