The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest all session content, including untrusted tool outputs, error messages, and file contents, to generate new reusable instructions. It lacks explicit boundary markers to prevent the agent from mistaking malicious instructions embedded in session data for legitimate knowledge to be codified.
Ingestion points: Full work session history processed by the agent (SKILL.md)
Boundary markers: Absent in the extraction prompts
Capability inventory: Writing new skills to the filesystem, searching knowledge bases, and capturing data to Open Brain
Sanitization: The skill includes a 'Quality Gate Checklist' that checks for credentials, but it does not filter for embedded prompt instructions.
[DYNAMIC_EXECUTION]: The skill's primary function is to generate new markdown-based skill files (SKILL.md) using templates populated with session data. These generated files are subsequently loaded by the agent, effectively allowing the skill to programmatically modify the agent's instruction set at runtime.
[COMMAND_EXECUTION]: The skill instructs the agent to perform file system operations, specifically reading from and writing to local skill directories (~/.claude/skills/ and .claude/skills/). These directories are sensitive as they define the agent's extended capabilities.

aiception