The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest conversation corrections and user feedback to perform repository maintenance and update its own instructions.
Ingestion points: Processes conversation corrections, user rejections, and user wording ('indirect phrases') to identify skill gaps (SKILL.md Protocol Step 1 and 3).
Boundary markers: The protocol lacks explicit boundary markers or isolation techniques to prevent user-supplied content from being treated as instructions during the update phase.
Capability inventory: The skill has broad write access to the repository, including modifying AGENTS.md, updating existing skill files, and creating new skill files across all configured agent directories (SKILL.md Step 5).
Sanitization: There is no evidence of sanitization, escaping, or verification of user-provided data before it is interpolated into permanent instruction files. A user could intentionally provide a 'correction' that, when processed by this skill, injects a persistent prompt injection into the agent's long-term memory or skill library.

common-session-retrospective