The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's core function is to ingest conversation history and extract new instructions to be added to skill files. This creates a surface where a malicious user could provide input designed to override safety guidelines or inject harmful behaviors that are then permanently stored in the agent's logic.
Ingestion points: The conversation_context transcript is scanned for learning signals in Phase 1 of the workflow.
Boundary markers: No specific boundary markers or delimiters are mentioned in the logic to separate untrusted user signals from system instructions during extraction.
Capability inventory: The skill uses Write, Edit, and Bash tools to modify file system content and commit changes.
Sanitization: The skill implements a 'preview-first' strategy and requires explicit manual approval for 'HIGH' confidence changes, which serves as a human-level sanitization gate.
[COMMAND_EXECUTION]: The skill uses the Bash tool to perform git operations (Phase 7) to version the evolution of the skills. While limited to git commands in the documentation, the allowed-tools frontmatter field provides broad shell access for the skill to perform these tasks.
[PERSISTENCE]: The skill is explicitly designed to create persistent behavioral changes across sessions by modifying SKILL.md files. This represents a form of instructional persistence that allows behavior-modifying patterns to persist beyond the boundaries of a single session.

reflect