The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to read and process data from project-level files (PROJECT_CONTEXT.md, DECISIONS.md, STATUS.md, LEARNINGS.md), which constitutes an attack surface for indirect prompt injection if these files are modified by an external actor.
Ingestion points: The agent reads four markdown files from the repository root at the start of sessions or when requested.
Boundary markers: The skill defines structured markdown formats and uses HTML comments as markers, though it lacks explicit "ignore instructions" delimiters for the content within those files.
Capability inventory: The skill possesses the capability to read from and write to the local filesystem within the repository context.
Sanitization: The skill implements strict quality gates, including deduplication, date-stamping, and a prohibition against conversational transcripts, which limits the potential for malicious instruction persistence.
[CREDENTIALS_UNSAFE]: The skill proactively addresses secret management by instructing the agent never to store credentials.
It explicitly forbids writing secrets, tokens, or personal data to memory files.
It specifies that only environment variable names should be recorded, while values should remain in standard .env files.

recall