The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructs the agent to perform self-modification by writing "reusable experience" back into its own SKILL.md, USAGE.md, or evals/evals.json files. This behavior creates a risk of instruction poisoning; if an attacker can manipulate a tool's output or the environment to produce a specific error, the agent might codify malicious instructions into its permanent skill set.
[COMMAND_EXECUTION]: The skill provides explicit instructions to execute PowerShell commands for file management and environment configuration. This includes reading and writing files with Get-Content, Set-Content, and Add-Content, as well as modifying session-level encoding settings and environment variables like $env:PYTHONUTF8.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: Technical error messages, logs from failed tools (apply_patch, quick_validate.py), and system status observations.
Boundary markers: None. The skill does not provide instructions on how to sanitize or delimit observations before they are written into the skill's persistent files.
Capability inventory: The skill has the capability to write to the file system and execute shell commands to resolve environment issues.
Sanitization: Absent. The agent is encouraged to record findings directly as "reusable experience" without validation or escaping.

toolchain-issue-recovery