The Agent Skills Directory

[DATA_EXFILTRATION]: The skill captures the entire thread history, including sensitive tool outputs (e.g., search results, file edits) and writes them to a local file. This can lead to the exposure of credentials, private code, or internal data if the output directory (defaulting to ./docs/threads/) is shared, checked into version control, or served by a web server.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the thread history, including content fetched from the internet via tools or read from local files, without performing sanitization.\n
Ingestion points: Full conversation history (messages and tool logs) processed during the dumping operation defined in SKILL.md.\n
Boundary markers: Minimal. The skill suggests starting padding for tool calls but does not use formal delimiters or escaping for the content being written to the file.\n
Capability inventory: File system write access to create the dump files and update the skill configuration.\n
Sanitization: None. The skill explicitly requires "exact same wording" and forbids any improvisation, effectively preventing the agent from filtering or sanitizing potentially malicious input.\n- [PERSISTENCE]: The skill implements a state-management mechanism by instructing the agent to modify its own source file (SKILL.md) to toggle the isFirstTime flag and update the default storage path.\n- [DYNAMIC_EXECUTION]: The requirement for the agent to rewrite parts of its own instructions at runtime is a form of self-modifying code.\n- [PROMPT_INJECTION]: The skill uses absolute constraints ("Do does not improvise even 0.001%", "no other thing, not even extra heading") to override the agent's default behavior, safety filtering, and summarization capabilities during the formatting process.

dump-thread