The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted data such as conversation history and code diffs, creating a surface for indirect prompt injection. However, it implements strong logical boundaries, including a requirement for separate explicit human approval for all actions and a structured output schema (RF-ID system) that prevents data from being interpreted as instructions. Ingestion points: The skill reads conversation logs, code changes, diffs, and implementation outcomes (SKILL.md). Boundary markers: The skill uses a rigid ID-based reporting structure (RF-01, RF-02) and a mandatory summary table at the end of the response. Capability inventory: The skill is restricted to reporting and classification; it cannot write files or execute scripts without separate approval, and it delegates creation to another tool. Sanitization: Instructions explicitly forbid the verbatim promotion of sensitive data like credentials, logs, or screenshots.
[DATA_EXFILTRATION]: The skill includes a dedicated safety rubric to identify and protect sensitive tokens such as API keys and PII. It enforces a 'report-only' mode by default and explicitly bars the extraction of raw secrets, significantly reducing the risk of accidental data exposure or malicious exfiltration.

tk-reflect