The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses ls and head via shell execution to locate transcript files in the local agent-transcripts directory. It uses a specific glob pattern designed to avoid crossing workspace boundaries or accessing private data in other projects.
[PROMPT_INJECTION]: The skill processes session transcripts, which are inherently untrusted data sources. It implements a robust defense-in-depth strategy by instructing reviewers (divergent-reviewer.md, judgment-reviewer.md, tooling-reviewer.md, synthesizer.md) to treat the input as untrusted, disregard embedded directives, and ignore instructions framed as user content.
[DYNAMIC_CONTEXT_INJECTION]: In SKILL.md, a shell command pattern is used to dynamically identify the most recent transcript files. This is limited to metadata discovery and does not process external or user-supplied arguments directly into the shell.
[REMOTE_CODE_EXECUTION]: While the skill spawns parallel subagents (Task calls), it explicitly sets readonly: false only for the purpose of MCP tool access (read-only context lookups) and strictly forbids subagents from modifying the repository or writing code. All edits are staged by the parent agent and require explicit human approval before application.

reflect