The Agent Skills Directory

[PROMPT_INJECTION]: The skill performs session analysis on untrusted conversation history to generate system-level modifications, exposing an indirect prompt injection surface.
Ingestion points: Conversation context and user feedback throughout the session.
Boundary markers: Absent; the agent scans the entire conversation stream for failure signals without isolation.
Capability inventory: The skill can write Bash wrappers to ~/bin/, Python hooks to .claude/hooks/, and modify autonomy-rules.md and settings.json. It executes git, gh, bash, and python.
Sanitization: Absent; user corrections and feedback are used as primary data for generating executable code and configuration changes.
[REMOTE_CODE_EXECUTION]: The skill implements dynamic code generation by creating new Bash scripts and Python hooks based on its diagnostic findings. These generated files are registered for automatic execution by the agent environment, establishing a mechanism for persistent dynamic code execution.
[COMMAND_EXECUTION]: The skill utilizes shell commands and the GitHub CLI (gh) to apply filesystem patches, commit changes, and interact with remote repositories through pull request creation and merging.
[DATA_EXFILTRATION]: The skill accesses sensitive internal agent logs, including ~/.claude/hooks/.log, stop-gate.log, and fact-ledger/.jsonl, which contain execution history and runtime metadata. While it targets GitHub (a well-known service), the systematic reading and potential export of internal logs via pull requests represents a data exposure risk.
[EXTERNAL_DOWNLOADS]: The skill interacts with external GitHub repositories using the GitHub CLI to synchronize patches and manage code, involving network operations to external servers.

retrospect