The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from user-specified folders which may contain malicious instructions.
Ingestion points: Processes content from a user-provided <folder>, including Obsidian vaults and personal journals (SKILL.md).
Boundary markers: There are no boundary markers or instructions to the agent to disregard instructions embedded within the ingested files.
Capability inventory: The skill executes Python scripts that read local files, modify a local memory database, and interact with external LLM APIs (SKILL.md).
Sanitization: No sanitization or filtering of the file contents is described before they are interpolated into the LLM context.
[DATA_EXFILTRATION]: The skill accesses private user directories and sends the content to external LLM providers.
Evidence: The skill requires an LLM_API_KEY and notes that every run consumes LLM credits, confirming that the content of private folders (like Obsidian vaults) is sent to external services (SKILL.md).
Sensitive data handling: A rule explicitly warns against printing .env files, acknowledging the agent's access to sensitive environment secrets within the ingested folders.
[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands to run scripts and manage the local database.
Evidence: The instructions include multiple uv run python commands to execute scripts within the repository and uv run cognee-cli to manage memory datasets (SKILL.md).

self-hosted-companion