The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external project artifacts (e.g., YAML or text files provided in the --inputs flag) to generate a summary for human review. This creates a surface for indirect prompt injection if an attacker can control the content of the artifacts being summarized.
Ingestion points: Artifact files specified via the --inputs argument in SKILL.md and processed in scripts/run.py.
Boundary markers: The instructions do not specify any delimiters or safety markers to differentiate between instructions and data in the artifacts.
Capability inventory: The skill has the capability to write to DECISIONS.md in the workspace.
Sanitization: No sanitization or escaping of the ingested artifact content is performed in the provided skill instructions or the wrapper script.
[DYNAMIC_EXECUTION]: The execution script scripts/run.py performs dynamic path resolution to find the repository root and modifies the Python environment at runtime.
Evidence: The script searches for an AGENTS.md file up the directory tree and then uses sys.path.insert(0, str(repo_root)) to allow importing modules from a computed path.

checkpoint-brief