The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted external data, such as chat export files and content fetched from URLs. This creates a vulnerability where malicious instructions embedded in a chat history could trick the agent into recommending harmful changes to the project's configuration files.
Ingestion points: Phase 1 in SKILL.md documents that the skill reads chat exports from local file paths and fetches content from external URLs using WebFetch.
Boundary markers: The skill does not specify the use of delimiters or specific instructions to isolate the analyzed chat data from the agent's own execution logic.
Capability inventory: Phase 4 in SKILL.md gives the agent the capability to update .cursorrules and modify or create skill files in the project and home directories.
Sanitization: There are no documented steps for sanitizing, validating, or escaping the content retrieved from external sources before it is used to generate configuration recommendations.
[COMMAND_EXECUTION]: The skill possesses the capability to modify critical project configuration files (.cursorrules) and skill definitions. Although a mandatory user confirmation step is included in the process ("STOP: Present findings and ask..."), the ability to persist changes to the user's environment based on the analysis of external, potentially attacker-controlled data is a significant capability.

post-mortem