The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from local files (GOAL.md and queries.md) and interpolates their contents into the generated PROTOCOL.md file. This creates a surface where malicious instructions in the input files could potentially influence downstream agents that read the resulting protocol.
Ingestion points: scripts/run.py reads content from workspace / "GOAL.md" and workspace / "queries.md".
Boundary markers: The script does not appear to use explicit delimiters or "ignore instructions" markers when wrapping this content in the output markdown.
Capability inventory: The script is limited to file system read/write operations within the workspace. It has no network or shell execution capabilities.
Sanitization: The script reads raw text and performs basic parsing without sanitization or escaping of the content before interpolation.
[DYNAMIC_EXECUTION]: The script dynamically modifies the Python path to import internal modules from the repository structure.
Evidence: scripts/run.py resolves the repository root by searching for AGENTS.md in parent directories and then uses sys.path.insert(0, str(repo_root)) to allow importing the tooling package. This is a standard architectural pattern for this environment and does not involve loading remote or untrusted code.

protocol-writer