The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes shell directives to execute CLI commands such as yy ledger workflow. This allows the agent to interact with the host system and the YYLO Ledger infrastructure to manage workflow records.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process workflow records from an external source (the YYLO Ledger), creating a potential attack surface where data retrieved from the ledger could influence agent actions.
Ingestion points: Untrusted data enters the agent context through the outputs of yy ledger workflow search and yy ledger workflow get commands in SKILL.md.
Boundary markers: The instructions do not define specific delimiters or "ignore instructions" warnings for the agent to use when interpreting data returned from the ledger.
Capability inventory: The agent has the ability to execute shell commands and create local files (e.g., workflow.yaml) based on instructions in SKILL.md.
Sanitization: While the Ledger tool validates YAML schema (e.g., schema_version, workflow_id), there is no evidence of sanitization for natural language fields like titles or descriptions which could contain malicious prompts.

workflow-yylo