The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data from session transcripts, PR review comments, and issue trackers to find durable learnings.
Ingestion points: Transcripts (transcript.jsonl), past agent sessions, and tracker text (issues/PR comments) are identified as primary data sources in references/reading-sources.md.
Boundary markers: references/lenses.md requires running analysis passes in a "fresh read-only subagent" and explicitly forbids tool calls within analyzed spans to prevent instructions in the data from being executed.
Capability inventory: The skill has the capability to write files via scripts/write-target.mjs, perform git operations, file issues using the gh CLI, and execute repository-defined check commands.
Sanitization: All untrusted data is passed via files or environment variables as per shared/external-data.md. Target paths and skill names are validated against strict character allowlists and repository containment checks in scripts/write-target.mjs.
[COMMAND_EXECUTION]: The skill executes several shell commands to interact with the repository and external trackers.
Evidence: It uses git for status and hashing, gh for issue creation and API access, and a repository-specific "check command" (e.g., linting or tests) during the apply turn as described in references/applying-edits.md.
Mitigation: The skill utilizes helper scripts (scripts/resolve-transcript.mjs and scripts/write-target.mjs) to ensure all command arguments are validated and that operations remain within the repository boundaries. Untrusted prose is never interpolated directly into shell strings.

running-retros