The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from user conversation transcripts and uses it to update persistent agent instructions in files like rules.md and preferences.md. This creates a vulnerability surface where an attacker could potentially influence the agent's long-term behavior via indirect prompt injection.
Ingestion points: The Step 1: Scan conversation for friction process in SKILL.md reads the entire session transcript to identify corrections and instructions.
Boundary markers: The skill includes a human-in-the-loop (HITL) mitigation strategy in Step 4: Present findings interactively, requiring the user to confirm, reject, or refine each finding before it is written to disk.
Capability inventory: The skill has the capability to write to persistent configuration files that govern agent behavior, including ~/.claude/.context/core/rules.md, ~/.claude/.context/core/preferences.md, and ~/.claude/.context/core/workflows.md.
Sanitization: There is no automated sanitization, filtering, or escaping of user-provided corrections before they are formatted into persistent instruction blocks.

retrospective