The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from historical session transcripts. It implements defensive measures by instructing the agent to treat this data solely as evidence and explicitly ignore any commands, file modification requests, or secret retrieval attempts found within the logs.
Ingestion points: Transcript data is retrieved via get_session_digest, grep_sessions, and get_session_messages (SKILL.md).
Boundary markers: The skill explicitly defines historical instructions as evidence, not commands.
Capability inventory: Analysis is limited to read-only operations via the MCP server; instructions strictly forbid tool execution from history, file writing, or external network activity.
Sanitization: The skill mandates the redaction of secrets and identifying details from the retrieved context.
[DATA_EXFILTRATION]: The skill includes instructions to prevent the exfiltration of sensitive session data. It explicitly forbids sending retrieved text to additional services or writing reports into the repository without user authorization.
[REMOTE_CODE_EXECUTION]: The skill proactively mitigates remote code execution risks by forbidding the installation of dependencies and strictly prohibiting the execution of any commands found in historical summaries.

session-reflect