The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read various external and untrusted files within the project repository, including AGENTS.md, CLAUDE.md, source code, and tests. These files serve as an ingestion point for potentially malicious instructions embedded by external actors, which could influence the agent's subsequent analysis or task execution.
Ingestion points: SKILL.md (Step 1: Reading project files and repository status).
Boundary markers: No explicit delimiters or instructions to ignore embedded prompts are provided in the skill definition.
Capability inventory: The skill possesses the ability to execute shell commands (via enable-shell-directives), start tasks (yy task start), and interact with a ledger API (yy ledger artifact).
Sanitization: There are no mentioned mechanisms for sanitizing or validating the content read from the project files before it is processed by the agent.
[COMMAND_EXECUTION]: The skill requires the use of vendor-specific CLI tools (yy task start, yy ledger artifact) to manage tasks and report findings. These tools are part of the yylo-dev toolset. While these appear to be standard functionality for this environment, users should ensure these tools are sourced from the legitimate vendor.
[DATA_EXPOSURE]: The skill is designed to inspect sensitive project metadata, including Kanban tasks, architecture, and runtime paths. Although this data is intended for the agent's internal planning, the skill specifies reporting these findings to external ledger APIs and other internal tools.

understand-project-yylo