The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the conversation history and persists it into the brain/ directory and skill files.
Ingestion points: The skill scans the entire conversation history for learnings and reads brain/index.md (SKILL.md).
Boundary markers: There are no explicit instructions or delimiters to prevent the agent from adopting malicious instructions embedded in the user conversation as legitimate 'principles' or 'rules'.
Capability inventory: The agent has the capability to write to local files in the brain/ directory and modify its own skill files in .agents/skills/ (SKILL.md).
Sanitization: The skill lacks validation or sanitization steps to filter out potential injection attacks from the conversation context.
[DYNAMIC_EXECUTION]: The skill encourages the agent to encode lessons structurally, which can include the creation of new scripts or lint rules.
Evidence: The 'Structural enforcement check' section explicitly suggests creating scripts to automate repeated manual steps, which involves generating executable or interpreted code at runtime.
[COMMAND_EXECUTION]: By instructing the agent to create and update scripts and skill files, the skill facilitates interaction with the file system and potential execution of generated automation scripts.

reflect