The Agent Skills Directory

[PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill ingests untrusted data from the local filesystem (filenames and directory paths) and incorporates them into markdown index and status documents used to guide agent behavior.
Ingestion points: The scan() function in scripts/scan_reference_library.py recursively identifies and reads metadata for all files within the reference/ directory.
Boundary markers: The metadata is formatted into markdown tables (e.g., in .agent/source-index.md). While structured, these tables lack explicit delimiters or instructions to the agent to disregard any instructional content found within the filenames or paths.
Capability inventory: The skill has access to the Bash, Write, and Edit tools, allowing it to execute scripts and modify project files based on its reading of the library index.
Sanitization: The slugify function in the scanner script sanitizes file stems for use as internal IDs, but the raw relative paths and filenames are written directly to markdown tables without escaping potential markdown control characters or prompt injection sequences.

reference-library-manager