The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill reconstructs workflows by processing historical session logs, prompts, and tool traces retrieved from the local ax database. This historical data constitutes untrusted input that could contain malicious instructions from previous sessions intended to subvert the agent during reconstruction.
Ingestion points: Historical logs and trace data accessed via ax sessions show and ax recall in SKILL.md.
Boundary markers: The instructions do not define clear delimiters (e.g., XML tags or specific markdown headers) to separate the ingested historical content from the agent's active instructions.
Capability inventory: The skill is designed for read-only summarization but has the capability to read any historical tool output or prompt stored in the ax database.
Sanitization: The instructions direct the agent to manually redact secrets and tokens, but there is no mechanism to sanitize the data against embedded command or prompt injection payloads.
[DATA_EXFILTRATION]: The skill retrieves detailed session history, which often contains sensitive environment information, proprietary code, and past interaction metadata. Accessing this repository of data increases the risk of accidental exposure of sensitive information within the agent's conversation.
Evidence: The skill uses ax recall and ax sessions show to extract content from the local ax database for analysis and reconstruction.

ax-extract-workflow