The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill analyzes potentially untrusted conversation history and feedback files to generate suggestions for updating persistent project and user-level documentation. This creates a surface for indirect prompt injection if malicious content in the conversation history influences the agent's proposed changes.
Ingestion points: The skill reads the full session conversation history (via the agent's context), wrapup-feedback.json, and various project/user documentation files such as CLAUDE.md, .claude/rules/, and ~/.claude/CLAUDE.md.
Boundary markers: The skill does not explicitly use delimiters or instructions to ignore embedded commands within the ingested text, but it implements a mandatory "REVIEW-ONLY MODE" requiring explicit user confirmation (Steps 4 and 5) before any persistent changes are applied.
Capability inventory: The skill utilizes Bash, Read, Write, and Edit tools to perform analysis and modify project-wide or global instructions.
Sanitization: The skill includes a 'PRIVACY RULES' section that explicitly prohibits the inclusion of secrets, API keys, credentials, personal information, or absolute paths in any destination files.
[COMMAND_EXECUTION]: The skill executes a local bash script to perform project root discovery and locate internal metadata directories.
Evidence: The SKILL.md file invokes bash "$DISCOVER" root using a local script path derived from the loading context. The scripts/discover.sh script uses standard system commands like git rev-parse and find to navigate the project structure safely without external network calls or privilege escalation.

dev-wrapup