The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes user conversation history, repository conventions, and workspace-scoped exports to generate new agent instructions. This ingestion of historical data creates a surface for indirect prompt injection if malicious content exists within the mined history.
Ingestion points: Scanned conversation history, workspace history resources, and explicitly supplied handoffs (found in SKILL.md).
Boundary markers: The instructions do not specify technical delimiters for the mined data, though they suggest using 'authorized history slices'.
Capability inventory: The skill is capable of drafting new mode-skill files and performing Git operations, including branch creation and pull request submission.
Sanitization: Mitigations include mandatory user confirmation of mined intent, an independent review pass using a specialized 'critic' model role, and the application of a host-specific skill validator.
[COMMAND_EXECUTION]: The skill interacts with the host environment to discover skill locations and uses the host's authoring tools. It also performs Git operations (branching and PR creation) to land changes in the repository.
[DATA_EXFILTRATION]: The skill mines sensitive user information including response style, autonomy preferences, and repository conventions. However, it explicitly forbids codifying sensitive traits or private information and lacks direct external network transmission capabilities outside of standard Git workflows.

automate-me