The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's core workflow involves the agent ingesting untrusted documents from a source directory (raw/), which presents a surface for indirect prompt injection attacks.
Ingestion points: scripts/ingest_source.py is used to read and preview external files (Markdown, HTML, JSON, CSV) from the user's local filesystem.
Boundary markers: The skill includes strong instructional boundaries. SKILL.md and the schema templates (CLAUDE.md.template, AGENTS.md.template) mandate a 'discuss-first' loop where the agent must present takeaways and key claims to the user and 'wait for confirmation' before updating the wiki.
Capability inventory: The skill possesses significant file-writing capabilities through several scripts, including init_vault.py (creates structure), update_index.py (regenerates catalog), append_log.py (updates history), and export_marp.py (generates slide decks).
Sanitization: There is no explicit sanitization of the content extracted from source files; the system relies on the LLM's inherent safety filters and the requirement for human-in-the-loop review to prevent malicious instructions from being executed or persisted.

llm-wiki