The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill reads and processes untrusted content from the target repository to inform its analysis and draft new objectives. This creates a potential surface for indirect prompt injection if the repo content contains instructions intended to influence the agent.
Ingestion points: Step 1 (Ground) explicitly reads the repository's README, CHOICES.md, ADRs, and recent work history.
Boundary markers: The instructions do not define specific delimiters or "ignore" warnings to distinguish between the skill's instructions and the repository data it processes.
Capability inventory: The skill can propose file modifications via PRs (Step 5) and invoke other internal skills like hillclimb (Step 6).
Sanitization: No explicit sanitization, filtering, or validation of the ingested repository content is mentioned.
Mitigation: The skill includes a robust human-in-the-loop mechanism in Step 5, stating "Never merge the interpretation yourself; the user approves (agents do not self-approve mission expansion — UM-0300)". This mandatory approval process effectively mitigates the risk of the agent executing injected instructions without oversight.

apply-mission