The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits a significant attack surface for indirect prompt injection as its primary function is to ingest and analyze untrusted data from multiple sources, including agent session logs (Claude, Cursor, Grok, Codex) and GitHub Pull Request data. Malicious instructions or tool outputs embedded in these logs could influence the agent during the "Judge" and "Act" phases, potentially tricking it into implementing backdoors or malicious modifications while attempting to "fix" its own skills.
Ingestion points: Session logs located in ~/.t3/ (processed by scripts/collect-sessions.mjs), SQLite projection databases (processed by scripts/collect-t3.mjs), and GitHub Pull Request content (processed by scripts/collect-prs.mjs).
Boundary markers: The skill relies on best-effort redaction logic in scripts/io.mjs but does not employ explicit boundary markers or instruction-separation techniques to distinguish between log content and agent instructions.
Capability inventory: The skill has the capability to modify its own source code in the hcaiano/skills repository, open/merge PRs, and execute arbitrary commands on remote hosts via SSH.
Sanitization: While scripts/io.mjs provides robust credential redaction to prevent accidental secret leakage, it does not sanitize the natural language or command content within the ingested logs.
[EXTERNAL_DOWNLOADS]: The skill uses npx -y skills@latest to install and run the skills utility from the npm registry. This pattern downloads and executes code without pinning to a specific version or hash, introducing a dependency on the external registry and the maintainer of the skills package.
[REMOTE_CODE_EXECUTION]: The "Act" phase in SKILL.md includes instructions for the agent to execute code on a remote MacBook (mbp) using SSH. This is used to synchronize and reinstall skills across the user's environment, but it represents a high-privilege capability that could be abused if the agent's decision-making process is compromised.
[COMMAND_EXECUTION]: The skill relies on several external CLI tools including ssh, scp, and the GitHub CLI (gh). scripts/collect-prs.mjs uses execFile to invoke gh api, which allows it to fetch and manage repository data at runtime.
[DATA_EXFILTRATION]: The skill aggregates sensitive interaction data, including shell history, tool inputs/outputs, and database records, into local state files under ~/.local/state/workflow-retro. Although the skill includes internal redaction logic to mask credentials, the systematic collection and consolidation of full agent histories represent an aggregation of sensitive information.

workflow-retro