The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function involves ingesting and summarizing potentially untrusted data from various sources, creating a surface for indirect prompt injection.
Ingestion points: Accesses chat transcripts located at the active harness's state directory/projects/<slug>/agent-transcripts/, and queries external records such as issue trackers, source control, and error tracking systems via the sibling skill ps-why.
Boundary markers: The skill instructs the agent to "Read only what the in-scope threads need" and stay on-topic, but lacks strict technical delimiters or delimiters for untrusted input.
Capability inventory: Employs git, gh, ls, and grep to collect information and spawns parallel subagents to process large volumes of data.
Sanitization: The instructions include a requirement to "sanitize private context before any public output," which provides some mitigation against data leakage. Notably, it implements an isolation strategy where raw transcripts are processed by subagents, and only findings are returned to the main thread.
[COMMAND_EXECUTION]: The skill utilizes local shell commands and CLI tools to gather context.
Evidence: The instructions explicitly direct the agent to use ls -t to order transcripts by time, grep to filter content, and git and gh to verify the state of pull requests and branches. These are appropriate and standard tools for the skill's purpose.

ps-recall