The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill mines user history and transcripts, which are considered untrusted data sources.
Ingestion points: Step 1 involves reading the active workspace's recent sessions and transcripts via the history recipe.
Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions to prevent the agent from obeying commands embedded within the historical transcripts.
Capability inventory: The skill can write files to the filesystem (SKILL.md), execute shell commands via git, and spawn parallel subagents.
Sanitization: There is no mention of filtering or sanitizing the content extracted from transcripts before it is clustered into new instructions.
[COMMAND_EXECUTION]: The skill utilizes system shell commands to interact with the environment and version control.
Evidence: Step 0 utilizes git log to determine last-edit timestamps, and Step 6 instructs the agent to use git worktree, git commit, and git push (via PR) to manage the skill's lifecycle.
[DYNAMIC_EXECUTION]: The skill generates new executable instructions for the agent at runtime.
Evidence: Step 4 describes the process of drafting and writing a SKILL.md file to the .agents/skills/ or home directory, which effectively creates new persistent behavior and configurations for the agent.

automate-me