The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes agent-transcripts/*.jsonl files, which contain untrusted user-supplied data and tool outputs. This creates a surface for indirect prompt injection where malicious instructions embedded in the transcript could attempt to influence the subagents' findings or the final skill edits.
Ingestion points: SKILL.md identifies and reads transcript files; subagents receive either the transcript file path or a session digest.
Boundary markers: The reviewer and synthesizer prompts in the references/ directory include explicit instructions to treat the transcript as untrusted data and ignore any embedded directives.
Capability inventory: The skill uses shell commands, spawns subagents with full tool access, and delegates file modifications to secondary tools.
Sanitization: The skill relies on natural language instructions for the LLM to ignore injected content; no programmatic filtering of the transcript content for safety is described beyond these instructions.
[COMMAND_EXECUTION]: The skill uses shell commands (ls) to locate transcript files within the workspace. This is a standard functional requirement for transcript processing.
[DYNAMIC_EXECUTION]: The skill generates and applies edits to other skills based on conversation analysis. This involves creating new executable instructions for the agent. This behavior is mitigated by a mandatory human-in-the-loop approval step before any changes are applied.

reflect