The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external training and validation datasets (e.g., datasets/train.jsonl, datasets/val.jsonl) and target prompt files (e.g., *.prompt.md). This untrusted content is passed to an optimizer capability to generate new prompt candidates. Malicious instructions within the datasets could potentially influence the behavior of the generated prompts or the agent's optimization logic.
Ingestion points: datasets/train.jsonl, datasets/val.jsonl, and target files (e.g., *.prompt.md) are read during Step 4 and Step 5 of the workflow defined in SKILL.md.
Boundary markers: The instructions do not specify the use of delimiters or 'ignore embedded instructions' blocks when providing dataset content to the optimizer.
Capability inventory: The skill can write files to the local system (Step 11 write-back) and execute shell commands (Step 9/11 validation).
Sanitization: No evidence of sanitization, filtering, or validation of the content within the ingested datasets is provided.
[COMMAND_EXECUTION]: The skill executes shell commands to perform its core functions. It runs a validation command (e.g., python -m pytest -q) to verify candidates in Step 11. It also executes a local repository script, .github/hooks/trainer-workspace.py, as defined in the workspace derivation section of references/prompt-loop-contract.md.
[DYNAMIC_EXECUTION]: The validation command is a dynamic input provided at invocation time (referenced in the argument-hint of SKILL.md). This creates a sink for executing arbitrary shell commands within the local repository environment during the validation phase of the training loop.

trainer-train-prompt