The Agent Skills Directory

[SAFE]: The skill demonstrates safe behavior and adheres to the principle of least privilege by only generating proposals rather than executing modifications. It does not perform network operations, access sensitive system files, or use obfuscation.
[PROMPT_INJECTION]: An indirect prompt injection surface exists because the skill processes project-generated data (specs and result files) to create code-related improvement proposals.
Ingestion points: The skill ingests progress.json, result.json, and archived spec markdown files from the specs/ directory as defined in SKILL.md §2.1.
Boundary markers: No explicit delimiters or boundary instructions are defined to separate untrusted input data from the agent's primary instructions.
Capability inventory: The skill generates markdown files containing specific code patch proposals for other skills, hooks, and workflow documents (SKILL.md §4, §5).
Sanitization: No input validation or filtering is specified to prevent malicious instructions within the project data from influencing the output proposals.
Contextual Mitigation: This surface is inherent to the skill's primary function of data-driven reflection. The risk of malicious code being injected into the codebase is effectively mitigated by strict instructional safeguards in SKILL.md §6 and §9, which mandate human review and explicitly prohibit the skill from performing automated file modifications.

learn