The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill analyzes potentially untrusted external data including conversation history, git logs, memory files, and session logs to generate permanent project instructions in files like CLAUDE.md and AGENTS.md. This creates a vulnerability surface where malicious instructions embedded in data could be promoted into the agent's core instructions.\n
Ingestion points: SKILL.md (Analyze Session History section) specifies conversation history, git log, memory files, and session logs as data sources entering the agent context.\n
Boundary markers (absent): The skill instructions do not define specific delimiters or "ignore embedded instructions" warnings for the ingested data to prevent the agent from accidentally obeying instructions found within that content.\n
Capability inventory: The skill possesses the capability to perform file writes across the project, specifically targeting core instruction files (CLAUDE.md, AGENTS.md, .team/coordinator-instructions.md) and state persistence files (WORKING_STATE.md), as detailed in the references/ directory.\n
Sanitization (absent): No escaping, validation, or filtering of external content is described before it is interpolated into persistent project directives.\n- [EXTERNAL_DOWNLOADS]: The documentation provides instructions to install additional functional components from the vendor's repository using a specific CLI command.\n
Evidence: The command npx skills add jwilger/agent-skills --skill memory-protocol in SKILL.md is used to download and integrate external code.

session-reflection