The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from repository files and external sources to frame and evaluate decisions.
Ingestion points: SKILL.md (Stage 1 and Stage 2) specifies reading repository code, schemas, and documentation as the basis for the deliberation process.
Boundary markers: The instructions lack defined delimiters or explicit 'ignore' directives to prevent the model from following instructions embedded within the analyzed repository files.
Capability inventory: Upon completion of the deliberation (or automatically when using the --autopilot flag), the agent is instructed to 'start implementing' the recommendation, which grants the skill a surface for file system modifications and code execution.
Sanitization: No sanitization, validation, or escaping of the ingested content is performed before the data is used to influence the final decision logic.

deep-deliberation