The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The agent generation templates and example agent configurations (such as the code-reviewer, security-analyzer, and test-generator in examples/complete-agent-examples.md) define operational workflows that ingest and act upon untrusted external data, including codebase files, pull request metadata, and user-provided descriptions. These ingestion points represent a surface for indirect prompt injection, where adversarial instructions embedded within the processed data could attempt to influence the agent's behavior.
Ingestion points: User-provided descriptions used as input for the agent architect persona (references/agent-creation-system-prompt.md) and project file content read by the generated agents using the Read tool.
Boundary markers: The documentation in references/triggering-examples.md recommends using <example> and <commentary> tags to delimit scenarios, which provides structural guidance but does not fully prevent instruction override.
Capability inventory: The example agents are granted significant capabilities including Read, Write, Grep, Glob, and Bash access to the filesystem and shell environment (as seen in SKILL.md and examples/complete-agent-examples.md).
Sanitization: The provided instructions and scripts do not include explicit logic for sanitizing or escaping ingested content before it is processed by the model, relying instead on the model's internal safety guardrails.

agent-development