The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from project notes, session logs, and external documentation to generate new instructions, skills, and agent behaviors. An attacker could place malicious instructions in logs or notes that the skill might incorporate into reusable agent assets during the reflection process.
Ingestion points: Reads AGENTS.md, .opencode/ and .slim/ directories, session logs, notes, checkpoints, and external documentation.
Boundary markers: The instructions do not define specific delimiters or isolation techniques for the ingested evidence sources.
Capability inventory: The skill can create and modify files (skills, agents, config, prompt overrides), define new commands, and adjust tool permissions.
Sanitization: While the skill instructs the agent to "respect privacy and safety boundaries" and "avoid using sensitive material," it lacks technical sanitization or validation of the ingested content.
[COMMAND_EXECUTION]: The skill has the capability to recommend and implement new custom commands and modify configuration files. Although it requires user confirmation before applying these changes, the generated commands represent a persistent execution vector.
[DYNAMIC_EXECUTION]: Reflect dynamically generates instructions for agents, skills, and configuration rules based on runtime evidence. This is a form of script generation where the logic is derived from potentially user-controlled or attacker-controlled data found in project artifacts.

reflect