The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The "improve" and "learn" sub-skills create a surface for indirect prompt injection by processing external feedback and evaluation data.
Ingestion points: improve/scripts/improve-cli.ts (via the --spec argument) and learn/scripts/src/learn.ts (via the --input argument) ingest JSON data containing evaluation failures, user corrections, and task objectives.
Boundary markers: The prompt templates generated by improve/scripts/vista-lib.ts interpolate this external data into agent instructions without using clear delimiters or explicit warnings to ignore embedded commands.
Capability inventory: The bundled TypeScript and JavaScript scripts possess file system read and write capabilities in the project workspace and the user's home directory (~/.agents).
Sanitization: The scripts perform format-specific character escaping (Turtle and YAML) but do not sanitize natural language instructions within the processed data.
[METADATA_POISONING]: The skill contains deceptive and future-dated metadata that misrepresents the timeline and existence of referenced research and models.
The metadata.json files are dated "February 2026", and instructions mention models that have not been publicly released (e.g., claude-sonnet-4-5-20250929, gpt-5-mini).
Reference documents cite multiple research papers with arXiv identifiers from the future (e.g., 2603.18388, 2605.23904). This misleading information could cause users or agents to misinterpret the maturity and official endorsement of the referenced standards.
[EXTERNAL_DOWNLOADS]: The skill references and provides instructions for downloading tools from various external sources.
Fetches the cagent CLI from Docker's official Homebrew tap.
Downloads the agentv tool from the npm registry and multiple Python libraries (assert-ai, gepa, trace-opt, skillopt, agentlightning) from PyPI.
References repositories and documentation from trusted organizations such as Anthropic, Google, Microsoft, and Coinbase.

ai