The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill operates on an inherent attack surface by ingesting large volumes of external, potentially untrusted data for context priming. However, it implements comprehensive mitigations:
Ingestion points: Local file system access via Explore and Grep tools, as well as potential web/MCP results mentioned in the consolidation logic.
Boundary markers: The protocol explicitly mandates that the lead agent must treat all quoted content as data and never execute instructions found within those quotes.
Capability inventory: File system exploration (Explore), file reading (Grep), temporary file creation (Write), and task tracking (TodoWrite).
Sanitization: The 'proof-of-work' requirement ensures all findings are verified using deterministic tool calls against source materials, preventing the agent from relying on potentially hallucinated or injected instructions in memory.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill accesses local files and writes temporary verification logs to the system's temporary directory. These activities are limited to the skill's stated purpose of investigation and verification, and no network exfiltration patterns were detected. The skill maintains a 'read-only' posture for its data sources.
[DYNAMIC_EXECUTION]: The skill uses runtime-specific mechanisms (like TodoWrite or inline notes) to manage a wave counter and track state across iterations. While this involves dynamic state management, it does not involve the generation or execution of arbitrary code.

prime-sweep