The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill retrieves and follows instructions from untrusted local files, creating a vulnerability surface for indirect prompt injection.\n
Ingestion points: The skill reads project-level settings from .agents/yesyak.json, user-level settings from ~/.agents/yesyak.json, and metadata blocks from AGENTS.md. It also ingests content from pull requests, specs, and plans.\n
Boundary markers: There are no explicit delimiters or instructions provided to the agent to ignore or sanitize embedded instructions within these data sources. The skill explicitly tells the agent to apply these as "extra instructions" or "replaced sections".\n
Capability inventory: The skill possesses read-only access to the file system, can execute git commands, and uses gh/glab to fetch remote data. It also executes a bundled Python script to parse and validate settings.\n
Sanitization: The check_yesyak.py script validates the JSON structure of the settings files but does not perform any sanitization of the natural language instructions contained within them before they are presented to the agent.\n- [COMMAND_EXECUTION]: The skill relies on executing external commands to function, which serves as the entry point for external data.\n
Tool usage: It executes git, gh (GitHub CLI), and glab (GitLab CLI) to read repository and pull request state. Arguments for these commands, such as branch names, are derived from the local environment, which could pose a parameter injection risk if the environment state is maliciously crafted.\n
Internal scripting: It executes a local Python script scripts/check_yesyak.py using python3. This script uses subprocess.run to execute git rev-parse to find the project root. The command is constructed as a list, which prevents shell injection.

ask-yak