The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data by mining recent agent conversation transcripts to identify user preferences. While this creates an attack surface where past instructions could influence the generated skill, the risk is inherent to the skill's primary purpose and is mitigated by the iterative review process.
Ingestion points: Conversation history accessed via t3_thread_read and t3_thread_search tools in SKILL.md.
Boundary markers: The skill does not explicitly define delimiters for mined data, but it requires the agent to summarize and cluster findings before drafting.
Capability inventory: Includes subagent delegation (delegate_task), file writing (via the skill-creator tool), and git operations (commit and PR creation).
Sanitization: Mined patterns are reviewed by the agent and the user before being committed to the file system.
[DATA_EXFILTRATION]: The skill accesses local conversation history and configuration files in ~/.agents/skills/. This is a core functional requirement and the skill includes specific instructions to prevent searching across unrelated projects or crossing workspace boundaries.

automate-me