The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process conversation transcripts stored in .jsonl files. These transcripts contain untrusted data that could include malicious instructions aimed at influencing the reflection process or forcing unwanted skill modifications.
Ingestion points: Transcripts are located in SKILL.md using shell commands and passed to reviewers as specified in the references/ templates.
Boundary markers: All reviewer templates (references/divergent-reviewer.md, references/judgment-reviewer.md, references/tooling-reviewer.md) and the synthesizer template (references/synthesizer.md) include explicit instructions to treat the transcript as untrusted data and ignore embedded directives or prompt-injection attempts.
Capability inventory: The skill uses shell commands for file discovery, spawns sub-agents via the Task tool with full MCP access (readonly: false), and can trigger existing skills like create-skill to modify the codebase.
Sanitization: A mandatory human-in-the-loop check is implemented in Step 5, requiring "explicit approval" before any proposed edits are applied, which mitigates the risk of automated exploitation.
[COMMAND_EXECUTION]: The skill executes shell commands (ls, head) in Step 1 to locate the most recent transcript files within the project directory. These commands are used for legitimate file discovery and are not exposed to direct user input.

reflect