The Agent Skills Directory

[PROMPT_INJECTION]: The skill scans the full conversation history (Step 1), which consists of untrusted data, to identify improvements and capture learnings.
[PROMPT_INJECTION]: The remember: hook (Step 6) instructs the agent to save content directly to persistent memory files without interpretation. This bypasses typical instruction-data separation and can be exploited via indirect prompt injection if an attacker places the marker in a context read by the agent.
[PROMPT_INJECTION]: Indirect Prompt Injection Surface:
Ingestion points: Reads full conversation transcript (SKILL.md, Step 1).
Boundary markers: Absent; the instructions do not specify the use of delimiters to isolate the analyzed transcript data.
Capability inventory: File-write to ~/.claude/projects/ (Step 4, 6), file-read via grep (Step 4), and the ability to modify other skill files through diff applications (Step 5).
Sanitization: No validation or sanitization is performed on the ingested conversation content before it is used for memory persistence or skill refactoring.
[DATA_EXFILTRATION]: The skill accesses sensitive filesystem paths at ~/.claude/projects/ to manage persistent agent state and project-specific memory.
[COMMAND_EXECUTION]: The SPEC.md file contains shell commands for validation and testing (e.g., python3 distillery/scripts/distiller.py) which could be abused if the agent is manipulated into executing them.

ia-reflect