The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to persist multi-session context within task notes and then retrieve that context in later sessions. This creates a surface for indirect prompt injection if malicious instructions are embedded in the task data.
Ingestion points: The agent is instructed to read task details and notes using commands such as bd show, bd ready, bd list, and bd search (referenced in SKILL.md).
Boundary markers: The instructions do not specify the use of delimiters or 'ignore embedded instructions' warnings when handling or reading task notes.
Capability inventory: The skill allows execution of shell commands via Bash(bd:*) and file access via the Read tool (configured in SKILL.md frontmatter).
Sanitization: There is no evidence of sanitization, validation, or escaping of external task content before it is processed by the agent.
[REMOTE_CODE_EXECUTION]: The skill provides a command for downloading and executing a remote shell script in SKILL.md and references/TROUBLESHOOTING.md: curl -fsSL https://raw.githubusercontent.com/steveyegge/beads/main/scripts/install.sh | bash. The script is hosted on GitHub, which is a well-known service, and the command is intended for the installation of the core tool required by the skill. The execution of this command is restricted by the allowed-tools configuration (Bash(bd:*)), which limits shell execution to commands starting with the tool prefix.
[EXTERNAL_DOWNLOADS]: The skill references the download of the bd CLI tool and associated installation scripts from GitHub (github.com/steveyegge/beads). These references target a well-known service and are part of the intended installation workflow for the tool the skill is designed to manage.
[METADATA_POISONING]: There is a discrepancy between the skill author provided by the platform ('ynulihao') and the author listed in the SKILL.md frontmatter ('Steve Yegge'). The frontmatter attributes the original author of the Beads tool, which appears to be for credit or attribution rather than deceptive intent, but it creates a metadata inconsistency.

beads