The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted historical session data to identify durable preferences and rules. This creates an indirect prompt injection surface where malicious instructions in past transcripts could influence the agent's long-term behavior.
Ingestion points: Project transcripts are read from ~/.claude/projects/ using jq in SKILL.md Section 1.
Boundary markers: There are no explicit boundary markers or 'ignore' instructions used when the agent processes the extracted transcript text.
Capability inventory: The agent has permissions to write to project configuration files, modify other skills, and configure persistence via shell scripts.
Sanitization: The skill relies on natural language instructions in the 'Distill' section to filter out sensitive or transient information rather than programmatic sanitization.
[COMMAND_EXECUTION]: The skill uses shell commands for environment detection, file system maintenance, and automation. This includes modifying ~/.claude/settings.json to install a SessionEnd hook and updating the user's crontab for scheduled tasks. These actions are performed to support the skill's primary functionality and are documented as opt-in.
[DATA_EXPOSURE]: The skill reads through user conversation history to identify learnings. It includes specific negative constraints to prevent the accidental capture of credentials, secrets, or transient environment state into the permanent memory files.

dream