The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes session transcripts that contain untrusted data, creating a surface where malicious user input could influence future agent behavior by tricking the system into proposing harmful skill modifications.
Ingestion points: Identifies and reads .jsonl transcript files from the agent-transcripts/ directory.
Boundary markers: Subagent instruction templates in the references/ directory (e.g., divergent-reviewer.md, judgment-reviewer.md, synthesizer.md) explicitly warn the agent to treat transcripts as untrusted and to ignore any embedded directives or prompt injection attempts.
Capability inventory: The skill can execute shell commands to locate files, spawn subagents with access to MCP tools (e.g., ticket trackers, observability logs), and modify skill files in the .cursor/skills/ directory.
Sanitization: The process relies on model-level instructions to disregard malicious content rather than using programmatic sanitization or filtering of the transcript data.
[COMMAND_EXECUTION]: The skill utilizes shell commands to manage and select conversation transcripts.
Evidence: SKILL.md contains a bash block that executes ls, head, and redirection to locate the most recent relevant transcript file within the workspace environment.

reflect