The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which could contain malicious instructions.
Ingestion points: The skill accepts 'Error logs, Git diffs, conversation history, and terminal history' as inputs in SKILL.md.
Boundary markers: Explicit technical delimiters for input data are absent in SKILL.md, relying instead on high-level logic for scope gating.
Capability inventory: The skill instructions in SKILL.md permit writing and modifying sensitive repository files including AGENTS.md, GitHub workflows in .github/**, and repository scripts, tasks, or helpers.
Sanitization: The SKILL.md file contains a 'Scope Gate' section to exclude secrets and personal data, and mandates masking sensitive information from UI or chat logs.
[DYNAMIC_EXECUTION]: The skill is designed to generate or update repository scripts and automation assets.
Evidence: Instructions in SKILL.md explicitly direct the agent to promote improvements to 'scripts, tasks, or helpers' and modify files within the scripts/ directory and .github/** folder. While intended for legitimate maintenance, this capability allows for the generation of executable content based on potentially tainted inputs.

retro-workspace