The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from conversation transcripts to perform audits and cross-model reviews.
Ingestion points: The skill uses t3_thread_read to ingest the entire conversation history into the agent's context for the purpose of verifying the decision log.
Boundary markers: While the instructions define a structured TSV format for the log, they do not specify delimiters or warnings to prevent the agent from obeying instructions embedded within the processed transcript content.
Capability inventory: The skill can write to the local file system (via log.sh), delegate tasks to sub-agents (via delegate_task), and search/read thread history.
Sanitization: The scripts/log.sh utility sanitizes input to prevent spreadsheet formula injection (CSV injection) by prefixing problematic characters with a single quote. However, it does not sanitize the text for LLM instruction injection.
[COMMAND_EXECUTION]: The skill executes a local shell script (scripts/log.sh) to maintain the decision log. This script processes arguments that may contain user-supplied or agent-generated text, which could lead to command-line issues if shell escaping was improperly handled, though the current implementation uses basic character stripping for safety.
[DATA_EXPOSURE]: The instructions for the Audit the log against the transcript section explicitly acknowledge that using the wrong projectId with t3_thread_search could expose unrelated private chats. The skill relies on the agent's internal instruction-following to avoid unauthorized data access across project boundaries.

show-me-your-work