The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes historical conversation transcripts to extract user preferences. If past conversations contained malicious payloads, they could theoretically influence the generated skill.
Ingestion points: Workspace session store transcripts (Step 1).
Boundary markers: Instructions limit mining to the current workspace scope and require pattern verification across multiple slices of history.
Capability inventory: The agent is permitted to read transcripts, write skill files, and perform git operations.
Sanitization: A refinement step (Step 5) uses the 'unslop' skill and authoring guidelines to filter and normalize the drafted prose.
[COMMAND_EXECUTION]: The skill utilizes local shell commands for metadata retrieval and version control.
Evidence: Step 0 uses git log to check file edit history. Step 6 utilizes git worktree and git commit for change management.
[DATA_EXPOSURE]: The skill accesses user transcripts and home directory paths to fulfill its primary function.
Evidence: Step 0 searches ~/.agents/skills/*-mode/SKILL.md. Step 1 reads the workspace's session store.
Mitigation: The skill contains explicit warnings to the agent not to "glob across other workspaces' transcripts" to prevent cross-workspace data leakage.

automate-me