The Agent Skills Directory

[DATA_EXFILTRATION]: The skill scans and reads files in the agent-transcripts/ directory of the workspace. These transcripts contain the user's private conversation history with AI agents, which is sensitive data processed to generate new instructions.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from past transcripts to influence its output. 1. Ingestion points: Workspace transcript files in the agent-transcripts/ directory. 2. Boundary markers: No explicit sanitization or delimiters mentioned for isolating transcript content. 3. Capability inventory: File writing (create-skill) and Git operations (commit, PR). 4. Sanitization: No specific sanitization or filtering of historical instructions is defined. Malicious instructions in past chats could be codified into the resulting personal skill.
[COMMAND_EXECUTION]: The skill utilizes shell commands, specifically git log for version history checking and git for creating worktrees, commits, and pull requests.

automate-me