The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill ingests untrusted text data from optional files located at the project root (BRAND.md, VOICE.md, and DISCOURSE.md) to augment downstream agent contexts.
Boundary markers: Content isolation is enforced using unique 128-bit cryptographic hex nonces generated at runtime by a trusted helper, preventing predictable injection termination attempts.
Capability inventory: The system leverages specialized sub-agents and subprocess shell executions to manage data extraction, text formatting, automated review loops, and visual validations using a headless browser engine.
Sanitization: The trusted loader script performs predictive structural scanning for high-risk prompt injection keywords (e.g., 'ignore previous instructions', 'bypass', 'override') and surfaces execution warnings when detected.
[COMMAND_EXECUTION]:
Description: The delivery loop executes local automation utilities (generate_hero.py, blog_render.py, blog_preflight.py) via system shell calls during quality gate enforcement.
Mitigation: Subprocess logic strictly refuses to resolve tools from the current working directory, instead validating execution solely against absolute system paths or specific operator-defined directories (CLAUDE_BLOG_SCRIPTS_DIR).

blog