The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill mines conversation transcripts to identify user working patterns, which introduces an attack surface where malicious instructions from past sessions could influence the agent's behavior.
Ingestion points: Conversation transcripts located in the active workspace's store, fanned out to subagents for analysis (Step 1).
Boundary markers: The instructions do not specify any delimiters or explicit warnings for the subagents to ignore instructions embedded within the processed transcript data.
Capability inventory: The skill possesses the capability to write files to the local file system (Step 4), execute git commands (Step 0, Step 6), and spawn further subagents (Step 1).
Sanitization: There is no evidence of sanitization, filtering, or escaping of the mined transcript content before it is incorporated into the draft of a new agent skill.
[COMMAND_EXECUTION]: The skill utilizes shell commands to manage its lifecycle, including using git log to determine last-edit timestamps (Step 0) and performing git worktree, commit, and pull request operations to deploy the resulting skills (Step 6).
[PERSISTENCE]: The skill attempts to modify the user's agent configuration by offering to add skill overrides to the ~/.claude/settings.json file (Step 4). This modification changes the agent's environment and how it loads skills across different sessions.

automate-me