The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from past run archives and arbitrary corpus prose without explicit sanitization or boundary markers.
Ingestion points: In Phase 1 (references/baseline-mining.md), the agent extracts the final_message from logs. In Phase 3 (references/corpus-audit.md), it reads the entire corpus directory for auditing.
Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions when ingesting this external content into the agent's context.
Capability inventory: The skill has the ability to spawn sub-agents (references/workflow-shapes.md) and perform file system writes (references/cut-passes.md).
Sanitization: There is no mention of filtering or escaping extracted prose before it is processed by secondary agents.
[COMMAND_EXECUTION]: The workflow relies on the execution of local shell utilities and the creation of custom scripts for data extraction and duplicate detection.
Evidence: The skill uses git log -S for provenance tracking (references/corpus-audit.md) and a shell pipeline involving find and shasum for identifying shared assets (references/cut-passes.md).
Context: These actions are consistent with the skill's primary purpose as a measurement-first tuning utility and are intended to be performed on local development artifacts.

ce-retune