The Agent Skills Directory

[PROMPT_INJECTION]: The 'Agentic OS' architecture involves agents reading and processing data from a data/ directory, including an inbox/ for new tasks and daily logs. This design creates an indirect prompt injection surface where untrusted content in project files could influence the agent's logic or routing decisions.
Ingestion points: Project files located in data/inbox/, data/projects/, and data/logs/ are identified as sources of truth for agent context (SKILL.md).
Boundary markers: The skill's architectural guidelines do not specify the use of delimiters or 'ignore' instructions to isolate processed data from the agent's primary instructions.
Capability inventory: The agents are granted extensive capabilities, including full filesystem access, Git operations, and the ability to execute slash commands, which increases the potential impact of an injection (SKILL.md).
Sanitization: The instructions lack guidance on validating or sanitizing the narrative and structured data stored in the data/ layer before it is consumed by agents.
[COMMAND_EXECUTION]: The skill provides detailed templates for creating persistence on the host system using macOS LaunchAgents, Linux systemd timers, and pm2. While intended for legitimate scheduled automation, these patterns describe how to maintain long-term process execution across system restarts (SKILL.md).

agentic-os