The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and process conversation transcripts, which are untrusted data sources that may contain malicious instructions or fake tool outputs intended to hijack the agent.
Ingestion points: Conversation transcripts are read from absolute file paths or session digests as specified in SKILL.md and referenced reviewer prompts.
Boundary markers: The skill employs clear safety delimiters and warnings across all sub-agent prompts (references/divergent-reviewer.md, references/judgment-reviewer.md, references/tooling-reviewer.md, and references/synthesizer.md), explicitly instructing the agent to treat transcripts as untrusted data and ignore embedded directives.
Capability inventory: The skill possesses significant capabilities, including the ability to query MCP tools (ticket trackers, observability platforms, chat logs, and source control) and the power to create or modify other skill files (SKILL.md).
Sanitization: The skill relies on natural language instructions to filter out prompt injection attempts within the transcript. The risk is significantly mitigated by the mandatory human approval step in SKILL.md (Step 5), which prevents the automatic application of suggested edits.

reflect