The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill analyzes the active conversation context to generate persistent project rules and new skill definitions. If the session includes untrusted data ingested from external files or web pages, malicious instructions within that data could influence the analysis phase, potentially leading the skill to propose harmful modifications to the agent's persistent configuration.
Ingestion points: The skill parses the entire active conversation history to identify signals such as user corrections, false hypotheses, and toolchain frictions.
Boundary markers: The skill does not employ explicit delimiters or instructions to distinguish between authoritative user feedback and data ingested from external sources during its analysis.
Capability inventory: The skill utilizes the Write and Edit tools to modify .claude/rules/, .claude/skills/, and CLAUDE.md, which are files that define the agent's long-term behavior and capabilities.
Sanitization: No specific content filtering or instruction-scrubbing is performed on the conversation history before it is processed for root cause analysis.
Mitigation: A strong human-in-the-loop safeguard is present; the skill is explicitly instructed to present all proposed edits in a table and wait for user validation before performing any write operations.

retro