The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on a local Python engine (scripts/run.py) to enforce a seven-phase state machine (bootstrap, perceive, goal_contract, etc.). The agent is instructed to execute this script for every transition, which acts as the authoritative source of truth for the task's progress.
[INDIRECT_PROMPT_INJECTION]: The engine scans the filesystem for policy files (AGENTS.md) and skill metadata to populate the agent's context.
Ingestion points: The load_policy function in scripts/run.py reads AGENTS.md from the home directory and climbs up the directory tree from the current path. The discover function reads SKILL.md files from multiple configuration paths.
Boundary markers: Data is passed back to the agent in a structured JSON format, which provides a layer of separation between the file content and the agent's instructions.
Capability inventory: The script performs file system read and write operations but does not perform network requests or execute arbitrary shell commands.
Sanitization: The script uses standard JSON parsing and a simple line-based parser for frontmatter metadata, but it does not validate the content of the rules or descriptions it ingests.
[DYNAMIC_EXECUTION]: The script dynamically assembles file paths for state persistence using unsanitized input from the execution payload.
Evidence: In scripts/run.py, the load_run and save_run functions use a user-provided run ID (e.g., f"{run_id}.json") and a dir parameter to determine where state files are read and written. A malicious payload could potentially use path traversal sequences (e.g., ../../) to read or overwrite JSON files outside the intended .agent-loop directory.

agent-loop