The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The README.md file and automated scanner alerts identify high-risk installation patterns where remote scripts from GitHub are piped directly into bash or PowerShell (iex). This allows the remote source to execute arbitrary code on the user's system without prior verification.
[COMMAND_EXECUTION]: The skill's operational commands, such as /reflect-yourself and /reflect-yourself-skills, instruct the agent to use filesystem tools to create directories and write executable or configuration-level files (like SKILL.md and .mdc rules) to sensitive local paths within the .cursor directory.
[DATA_EXFILTRATION]: The bin/install.js script and the main command instructions perform network operations to the npm registry (registry.npmjs.org) to verify versioning. While standard for many tools, this represents a non-whitelisted network connection originating from the skill's logic.
[PROMPT_INJECTION]: The skill processes untrusted conversation data to influence future agent behavior, representing an indirect prompt injection risk.
Ingestion points: The agent's conversation history is ingested during analysis by the /reflect-yourself and /reflect-yourself-skills commands.
Boundary markers: The rules/session-reflect.mdc file provides instructions to delimit and summarize learnings rather than executing them verbatim, though the primary SKILL.md does not enforce strict delimiter usage for the ingestion phase.
Capability inventory: The skill has broad capabilities to write, modify, and delete files in the .cursor/skills/ and .cursor/rules/ directories across both project-specific and global personal scopes.
Sanitization: The instructions in rules/session-reflect.mdc and the 'Safety & Provenance' section of commands/reflect-yourself.md advise the agent to sanitize and summarize learned content, though the implementation depends on the agent's adherence to these instructions.

reflect-yourself