The Agent Skills Directory

[PERSISTENCE_MECHANISMS]: The skill automates the configuration of persistence through harness-specific hooks. Specifically, it modifies .claude/settings.json for Claude Code, config.toml for Codex, and .opencode/plugins/ for OpenCode. These hooks (SessionStart, PostToolUse, PreToolUse, Stop) execute shell commands at the beginning, end, and during specific tool events in every agent session. This behavior is intended to enforce session rituals like NKS orientation and memory management.
[PROMPT_INJECTION]: The references/agents-template.md file includes explicit instructions designed to override platform-level behaviors. Specifically, it contains a directive stating, "This overrides the harness's own memory instruction," which is used to redirect the agent from using local project memory to using the NKS graph or repository files. This is a functional override necessary for the skill's stated purpose of centralized state management.
[INDIRECT_PROMPT_INJECTION]: The skill establishes an indirect prompt injection surface by ingesting data from untrusted sources within the repository to generate configuration files.
Ingestion points: Files including package.json, README.md, tsconfig.json, CI yaml files, and git remote outputs are parsed (SKILL.md, Procedure Steps 1-7).
Boundary markers: The procedure includes checks to ensure no template slots (<...> or ) remain in the final output, providing a basic delimiter for generated content.
Capability inventory: The skill has the capability to write to the file system (AGENTS.md, harness settings), modify agent execution hooks, and interact with the nks_* MCP toolset.
Sanitization: The instructions emphasize "sanity-checking" derived facts against the code, though they lack explicit escaping mechanisms for raw data interpolated from repository files.
[DYNAMIC_EXECUTION]: In Step 4, the skill generates complex shell command strings (using jq, grep, and echo) that are stored in the agent's configuration and executed dynamically by the harness. These commands gate agent actions, such as blocking writes to the local memory directory.

verstakify