The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from session logs and repository configurations, which could contain malicious instructions designed to influence the agent's behavior during the retrospective process.
Ingestion points: SKILL.md directs the agent to read "transcript, tool results, and existing decision logs" as well as "relevant repository configuration" (e.g., docs/agents/workflow.md).
Boundary markers: The instructions do not define specific delimiters or "ignore embedded instructions" warnings for the processed data, although they do implement a safety checkpoint by requiring explicit user approval for any proposed changes.
Capability inventory: The skill has the capability to modify files and execute shell commands ("apply [remedies]... and run the affected checks").
Sanitization: No explicit sanitization, escaping, or validation of the ingested logs or configuration files is performed before they are used to generate recommendations.

retro