The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes conversation transcripts which are untrusted data sources. A malicious transcript could contain instructions designed to trick the analysis subagents into recommending harmful skill edits or performing unauthorized actions via MCP tools.
Ingestion points: Transcript files (.jsonl) are identified and read from the agent-transcripts/ directory as described in SKILL.md.
Boundary markers: The subagent prompts in references/judgment-reviewer.md, references/tooling-reviewer.md, references/divergent-reviewer.md, and references/synthesizer.md contain explicit instructions to treat the transcript as untrusted data and ignore any embedded directives.
Capability inventory: Subagents are given MCP access (readonly: false). The parent agent can perform shell commands, edit skill files, and invoke the create-skill tool to apply changes.
Sanitization: The skill relies on model instructions to ignore malicious content and a mandatory user approval step rather than automated sanitization of the transcript content.
[COMMAND_EXECUTION]: SKILL.md directs the agent to run a shell command (ls -t <agent-transcripts>/*.jsonl ...) to find transcript files. This represents direct execution of shell commands based on skill instructions to interact with the file system.
[DATA_EXPOSURE]: The skill accesses historical conversation transcripts. The instructions include a specific warning to avoid reading transcripts from unrelated projects to prevent cross-workspace data exposure, but the mechanism relies on the agent following these instructions correctly during file discovery.

reflect