The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes .specstory/history/*.md files to generate a personalized LLM summary. These files contain chat histories that are technically untrusted external data, which could be used to embed malicious instructions targeting the AI agent.
Ingestion points: The parser in scripts/lib/parser.py extracts messages, file references, and tool calls directly from history files.
Boundary markers: The skill does not implement boundary markers or instructions to ignore potential injections within the session data.
Capability inventory: The skill can execute git blame via subprocess and perform file system read/write operations for report generation.
Sanitization: There is no sanitization or escaping of the message content before it is processed by the LLM for summarization.
[COMMAND_EXECUTION]: The skill executes external system commands to gather metadata about session files.
Evidence: The scripts/lib/utils.py file uses subprocess.run to call git blame on history files.
Analysis: Although the command is implemented safely using a list of arguments without a shell, it remains a capability to execute system binaries based on local file paths.

specstory-yak