The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill describes a pattern where project-local configuration files (.claude/*.local.md) are ingested and their markdown content is fed back to the agent as instructions or prompts, creating a vulnerability surface for indirect prompt injection.
Ingestion points: Project-root files matching the pattern .claude/*.local.md are intended to be read by hooks, commands, and agents to adapt behavior per project (documented in SKILL.md, references/parsing-techniques.md, and references/real-world-examples.md).
Boundary markers: The examples provided for extracting and using the markdown body content do not demonstrate the use of delimiters or specific "ignore instructions" wrappers to protect the agent from executing commands embedded within these files.
Capability inventory: The skill facilitates file reading via Bash scripts and interpolation of that data into agent prompts or control logic, such as the session-looping mechanism in the ralph-loop example (documented in references/real-world-examples.md).
Sanitization: While the documentation correctly recommends using jq -n --arg for safe JSON construction, it lacks guidance on sanitizing the textual content itself to prevent the agent from following malicious instructions found in project-local files.

plugin-settings