The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted historical data from past sessions and GitHub Pull Request review comments to generate new persistent instructions or code changes.
Ingestion points: Reads from messages.jsonl (local session history via the prompt-mirror skill) and external GitHub PR review comments via the GitHub API.
Boundary markers: Lacks explicit delimiters or instructions to ignore embedded commands within the ingested session logs or review comments.
Capability inventory: Possesses the ability to modify repository-wide instructions (.github/copilot-instructions.md), create Pull Requests, and execute local scripts.
Sanitization: Although the skill instructs the agent to redact quotes and show the final evidence block to the user, there is no validation for the input data to prevent malicious instructions from being 'mined' as legitimate corrections.
[COMMAND_EXECUTION]: The skill executes a local Python script to perform data mining on session history.
Evidence: Invokes python3 <skills-dir>/prompt-mirror/scripts/mine_sessions.py --since 21d to extract correction classes and phrases.
[DATA_EXFILTRATION]: The skill accesses local session history and personal configuration files, formatting the data for potential publication to external/shared GitHub repositories.
Sensitive data access: Reads personal agent instructions (~/.copilot/copilot-instructions.md) and local session logs containing previous interactions.
Transmission: The mined data is intended to be placed in an 'evidence block' within a GitHub Pull Request.
Mitigation: The skill includes instructions to redact quotes and requires the user to approve the evidence block before it is published.

steer-once