The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill analyzes the current conversation to identify corrections and propose changes to other skill files. This creates an attack surface where malicious text in the conversation could influence the agent to suggest backdoors or unsafe modifications to other skills.
Ingestion points: Conversation history and user-provided feedback.
Boundary markers: No explicit delimiters are used to separate user data from analysis logic.
Capability inventory: The skill can read, edit, and write files, as well as execute git commands (commit and push).
Sanitization: The skill mitigates this risk by requiring explicit user review and approval ([Y/n]) before applying any changes.
[COMMAND_EXECUTION]: The skill uses the Bash tool to perform system-level operations.
Evidence: Executes git add, git commit, and git push within the .claude/skills directory.
Evidence: Manages a state file at ~/.claude/reflect-skill-state.json to persist user settings across sessions.
Context: These operations are consistent with the skill's stated purpose of managing a skill repository and maintaining state.

reflect