The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local Node.js utility scripts (validate-mirror-record.mjs, save-mirror-record.mjs) to perform capability assessments and manage a local, append-only history of reports. These operations are restricted to the skill's local directory and a user-specified root directory.
Evidence: SKILL.md contains instructions to execute node <skill-root>/scripts/validate-mirror-record.mjs --root <照镜子履历根目录> and node "<skill-root>/scripts/save-mirror-record.mjs".
[INDIRECT_PROMPT_INJECTION]: The skill processes external data sources including chat records and project workspace files to generate growth assessments, which presents an attack surface for instructions embedded within the ingested data.
Ingestion points: The skill reads Codex/Chat 记录 (conversation history) and Git/工作树 (workspace files) as evidence sources.
Boundary markers: The skill instructs the agent to categorize evidence (e.g., exact, user-reported, phase-estimate) and enforces a structured JSON schema, though it lacks explicit natural language delimiters for raw log processing.
Capability inventory: The skill has file system access to read project files and write report artifacts (JSON, HTML, Markdown) to a local directory.
Sanitization: The validate-mirror-record.mjs script implements desensitization logic using regular expressions (SECRET_LITERAL, SENSITIVE_KEY) to detect and block the persistence of API keys, access tokens, and private keys during the save process.
[DATA_EXPOSURE]: The skill handles potentially sensitive project state and conversation data. It mitigates exposure risks by providing explicit instructions to avoid saving raw logs or credentials and by including a validation script that prevents the accidental storage of secrets.
Evidence: scripts/validate-mirror-record.mjs contains a scanSensitive function designed to identify and reject records containing sensitive fields like apiKey, sessionKey, or RSA PRIVATE KEY.

reflect-on-vibe-code-growth