The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external data from conversation transcripts to automate the creation of new instructions, which represents a potential attack surface if those transcripts contain malicious content.
Ingestion points: agent-transcripts/ directory in the active workspace.
Boundary markers: The skill instructs the agent to summarize and "cut ruthlessly," but does not specify technical delimiters to isolate the source text.
Capability inventory: The skill uses create-skill to write to the filesystem and performs git operations like commits and pull requests.
Sanitization: Includes human-in-the-loop verification steps using the AskQuestion tool and iterative draft reviews.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill is designed to read workspace conversation transcripts to perform its primary function. It includes explicit guardrails to prevent data leakage from other projects by restricting directory access to the current workspace scope only.

automate-me