The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to audit its decision log by reading session transcripts from the agent-transcripts/ directory. This ingestion of potentially untrusted data from previous session steps creates an indirect prompt injection surface.
Ingestion points: Transcript files located in the agent-transcripts/ directory, as specified in the audit instructions in SKILL.md.
Boundary markers: No specific delimiters or protective boundary instructions are provided to the agent for parsing these transcript files.
Capability inventory: The skill utilizes scripts/log.sh to perform file system writes (appending to TSV files) and directory creation.
Sanitization: The scripts/log.sh script includes a clean function that removes control characters (tabs, newlines) and prepends a single quote to cells starting with =, +, -, or @. This is a proactive security measure to prevent CSV/spreadsheet formula injection when the log is opened in tools like Excel or Google Sheets.
[COMMAND_EXECUTION]: The skill includes a bash script scripts/log.sh that executes directory creation (mkdir -p) and file appending (printf >>). These are standard file system operations, but they represent a functional capability that the agent must manage securely according to the path restrictions in SKILL.md.
[DATA_EXFILTRATION]: The skill requires access to session transcripts, which are sensitive files containing interaction history. The skill instructions demonstrate security awareness by explicitly warning the agent: "Don't glob across ~/.cursor/projects/*/. That reads unrelated private chats."

show-me-your-work