The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external data including task history and repository content which could contain malicious instructions.
Ingestion points: The skill reads local task history, conversation logs, and repository artifacts via git and file system access (SKILL.md sections 2 and 3).
Boundary markers: The instructions explicitly mandate returning only facts and keeping extracted history local to child agents, which reduces the impact of potentially malicious embedded instructions.
Capability inventory: The skill is scoped to read-only access to git, local files, and host-specific task histories. It has no capabilities for external network transmission or writing to the filesystem.
Sanitization: The agent is instructed to filter history for facts and synthesis, and to cite exact sources while distinguishing facts from inference.
[COMMAND_EXECUTION]: The skill utilizes local shell commands to gather context about the current repository state.
Evidence: The instructions utilize git status, git branch, git log, and git diff as seen in SKILL.md sections 3 and 4.
[EXTERNAL_DOWNLOADS]: The skill documentation references source material from a well-known third-party repository.
Evidence: THIRD_PARTY_NOTICES.md references the Cursor plugins repository at https://github.com/cursor/plugins.

recall