The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the git log command to check the timestamp of the last edit on existing skill files. This is used to determine the scope for mining new history. The command is executed on paths identified during a recursive search of localized skill directories.
[INDIRECT_PROMPT_INJECTION]: The skill operates by mining untrusted data (past thread history) to generate instructions for a new agent skill. This creates an inherent surface for indirect prompt injection, as malicious or misleading content in historical logs could potentially be codified into the user's permanent agent settings.
Ingestion points: Historical thread data is ingested via t3_thread_read and t3_thread_search as described in Step 1 of the SKILL.md file.
Boundary markers: The skill explicitly mandates a human-in-the-loop review process in Step 5, where the draft must be shown to the user for feedback and iteration before it is finalized.
Capability inventory: The skill possesses the capability to write new skill files to .agents/skills/ and ~/.agents/skills/, and to perform git operations (worktree, commit, PR) to persist the changes.
Sanitization: Robust guardrails are included to mitigate the risk of poisoning, such as requiring signals to appear in at least two separate history slices and explicitly warning against overfitting to a single conversation.

automate-me