The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to update files that the agent uses as system instructions for future tasks. This creates a persistent injection surface where a malicious input or "lesson" could be codified into the project's durable context.
Ingestion points: Untrusted data enters via user-confirmed writing preferences, editorial lessons, and observations derived from current interaction history.
Boundary markers: The instructions do not specify using delimiters or "ignore" blocks when appending new rules to context files in SKILL.md, which would help distinguish generated rules from core system instructions.
Capability inventory: The skill has the capability to read and write to critical governing files like VOICE.md, STYLE.md, and workflow documentation as described in the "Classify The Learning" section.
Sanitization: There is no explicit sanitization or filtering of the content being written; the skill relies on the agent's instructions to "Write Precisely" and a manual confirmation step for inferred lessons.

cw-save