The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of data from external files into the agent's context window to offload verbose information like logs and plans.
Ingestion points: The agent reads data from the .gemini/scratch/ and .gemini/plans/ directories, as well as SKILL.md files as described in references/implementation-patterns.md.
Boundary markers: The instructions do not define specific delimiters or validation logic to ensure that data read from these files does not contain executable instructions that override agent behavior.
Capability inventory: The skill utilizes file read and write operations across its proposed directory structure to manage state and sub-agent communication.
Sanitization: While a 'Self-Modification Guard' is mentioned to limit the size of entries in preferences.yaml, there is no evidence of content sanitization or instruction filtering for incoming data.
[DYNAMIC_EXECUTION]: The skill implements a 'Dynamic Skill Loader' pattern which encourages the agent to load the full content of SKILL.md files on-demand during a session.
Evidence: The SKILL.md file explicitly describes loading full skill instructions (e.g., skills/advanced-evaluation/SKILL.md) when the agent deems it relevant, effectively performing dynamic context injection at runtime.
[PERSISTENCE]: The skill is designed specifically to maintain state across session restarts by utilizing the filesystem as a 'hard drive'.
Evidence: The 'Plan Persistence' and 'Sub-Agent Workspace' patterns describe saving task objectives, status, and activity logs to persistent files in the .gemini/ directory to allow agents to resume work in subsequent sessions.

filesystem-context