The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructions direct the agent to read external project files such as CONTEXT.md and the existing codebase to match domain language and respect architectural decisions. This ingestion of untrusted data presents a surface for indirect prompt injection, as malicious instructions could be embedded in the source code or documentation processed by the agent.
Ingestion points: Referenced project files and CONTEXT.md as described in SKILL.md.
Boundary markers: The instructions do not define specific delimiters or warnings to ignore embedded instructions within the ingested files.
Capability inventory: The agent typically maintains file system access (read/write) while performing TDD tasks.
Sanitization: No explicit sanitization or validation steps are provided for the content of the external files before processing.

tdd