The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data in the form of session transcripts and summaries to generate documentation. While the helper script is read-only and does not parse message content for instructions, the agent itself could be influenced by malicious content within a transcript during the synthesis phase.
Ingestion points: Session transcripts (SKILL.md) and JSONL log files (evaluate-session.sh).
Boundary markers: The instructions do not specify technical delimiters but enforce a synthesis process ('Prefer a minimal synthetic example to copying a transcript') which acts as a logical boundary.
Capability inventory: Read-only file access to logs and write access to authorized documentation paths.
Sanitization: The procedure mandates the removal of secrets, usernames, absolute paths, and private messages before any output is saved.
[DYNAMIC_EXECUTION]: The helper script evaluate-session.sh uses a heredoc to execute an inline Python script. This is used for counting message objects and is implemented with defensive checks, including O_NOFOLLOW to prevent symlink attacks and hard limits on file and line sizes.

cc-skill-continuous-learning