The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes session transcripts which are untrusted data sources that could contain malicious instructions or deceptive tool outputs designed to influence the agent. Findings are derived from these transcripts and could potentially lead to the introduction of malicious instructions into other skills. \n
Ingestion points: Transcript files located in ~/.claude/projects/ are read by the find-transcript.mjs script and passed to reviewer subagents as described in SKILL.md.\n
Boundary markers: Structural placeholders like <ABSOLUTE_PATH>, <DIGEST>, and <JUDGMENT_OUTPUT> are used to delimit the untrusted content within the reviewer and synthesizer prompts.\n
Capability inventory: The skill utilizes the Agent tool to spawn subagents, executes a local Node.js script for transcript discovery, and performs file writes to update skill definitions within the workspace.\n
Sanitization: All reviewer and synthesizer prompts in the references/ directory include explicit directives to treat transcript content as untrusted, ignore embedded instructions, and limit MCP tool usage to referenced context. User approval is required before any suggested edits are applied to the filesystem.\n- [DATA_EXFILTRATION]: The skill accesses the user's private conversation history stored in ~/.claude/projects/. These logs are sensitive as they may contain credentials or private information shared during previous sessions. The skill processes this information locally to generate insights but does not transmit it to external domains.\n- [COMMAND_EXECUTION]: The skill executes a local Node.js script find-transcript.mjs to search through session logs. This involves running a shell command with user-influenced arguments like the project directory and prompt fragments.

reflect