The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes user-generated text from a local database without using boundary markers or sanitization logic to distinguish between data and instructions.
Ingestion points: Data is read from the timeline_cards and journal_entries tables in ~/Library/Application Support/Dayflow/chunks.sqlite (seen in SKILL.md).
Boundary markers: No delimiters or 'ignore embedded instructions' warnings are present to scope the retrieved data.
Capability inventory: The skill has no network, shell, or file-writing capabilities across its script and instructions, which mitigates the risk of an injection causing data exfiltration or system modification.
Sanitization: No input validation or content filtering is implemented for the data retrieved from the database.
[SAFE]: The skill accesses a local application database path (~/Library/Application Support/Dayflow/chunks.sqlite). This access is necessary for the skill's primary stated purpose of reviewing productivity trends.
[SAFE]: No network operations, credential theft, or remote code execution patterns were identified in the analysis.

dayflow-review