The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill extracts information from previous conversation segments to create reusable artifacts, which is a potential surface for persisting malicious instructions if the user provided them earlier. However, the skill provides strong mitigations by instructing the agent to trigger only on explicit user requests and to remove private or sensitive context.
Ingestion points: Natural language conversation history and latest user-authored requests in SKILL.md.
Boundary markers: Includes rules to trigger only from the latest user-authored request and to avoid assistant-authored plans or examples.
Capability inventory: The skill specifies writing artifacts to local workspace directories such as skill-work/ or plugin-work/.
Sanitization: Explicitly requires the removal of secrets, local-only paths, and private context before writing the artifact.
[CREDENTIALS_SAFE]: The 'Capture Workflow' section contains a specific rule to 'Remove private context, local-only paths, secrets, and one-off details,' effectively mitigating accidental credential exposure during the capture process.
[DATA_EXFILTRATION_SAFE]: The skill only suggests local workspace destinations for artifacts and contains no instructions for external network operations, base64 obfuscation, or sensitive system path access.

workflow-capture