The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary workflow involves reading and analyzing conversation transcripts (via t3_thread_read), which are inherently untrusted and may contain malicious directives.
Ingestion points: The transcript content is retrieved in SKILL.md and passed as input to reviewer subagents using templates in the references/ directory.
Boundary markers: The skill includes robust mitigations by explicitly instructing subagents in references/divergent-reviewer.md, references/judgment-reviewer.md, and references/tooling-reviewer.md to treat transcripts as untrusted data and ignore embedded instructions.
Capability inventory: The skill utilizes delegate_task for sub-analysis, npx skills for package installation, and has the ability to read/write local skill files and access MCP tools.
Sanitization: The process relies on synthesis across multiple specialized agents and mandates explicit user approval before any permanent skill modifications are applied.
[EXTERNAL_DOWNLOADS]: The skill uses npx skills@latest to install and link local skill modifications, which fetches code from the public npm registry at runtime.
[COMMAND_EXECUTION]: Execution of shell commands is used for skill management tasks, including the use of npx and potentially local validators or the skill-creator utility.
[DYNAMIC_EXECUTION]: The core function of the skill is the dynamic modification of agent logic. It generates new or edited instructions based on session transcripts and installs them into the agent's environment, albeit with a human-in-the-loop requirement.

reflect