The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes all markdown artifacts from completed runs (including requirement docs, summaries, and audit logs) as source material for memory extraction. This creates an attack surface where malicious instructions embedded in data from a previous session could be persisted into the repository's long-term memory plane.
Ingestion points: Processes all markdown files located in /.recursive/run/<run-id>/.
Boundary markers: No specific delimiters or "ignore instructions" directives are mentioned for the artifacts being parsed.
Capability inventory: The skill writes to local memory files and triggers external extraction commands, which could be influenced by injected content.
Sanitization: The documentation does not specify sanitization or validation of the markdown content before it is passed to the extraction engine.
[COMMAND_EXECUTION]: The skill utilizes the RECURSIVE_TRAINING_EXTRACTOR_CMD environment variable to define an external command for evaluating training prompts. This configuration point allows for the execution of arbitrary external tools, which is a potential risk if the environment is not secured.
[DYNAMIC_EXECUTION]: The training scripts dynamically assemble commands using placeholders such as {repo_root} and {prompt_file}. This pattern represents a potential surface for command injection if the repository path or environment context contains malicious shell characters.

recursive-training