The Agent Skills Directory

[SAFE]: The skill is a documentation and harness engineering framework designed to produce verifiable artifacts while maintaining clear security boundaries and authority hierarchies.
[INDIRECT_PROMPT_INJECTION]: The skill inherently processes external data such as web pages, PDFs, and tool outputs, creating a potential attack surface. However, it implements comprehensive mitigations that align with security best practices:
Ingestion points: External data sources are clearly identified in SKILL.md and rules/sourcing.md (e.g., web snippets, PDFs, logs).
Boundary markers: The skill explicitly mandates that retrieved content must be treated as evidence only and never as executable instruction authority (SKILL.md, rules/sourcing.md, rules/harness-engineering.md).
Capability inventory: The skill manages file access and tool usage through a strictly tiered authority model where project-level instructions outrank all external data (rules/context-engineering.md).
Sanitization: It includes specific directives to ignore commands or 'ignore previous instructions' overrides embedded in external text, treating them as data to be evaluated rather than commands to be followed (rules/forbidden-patterns.md, rules/harness-engineering.md).
[EXTERNAL_DOWNLOADS]: The skill contains references to official documentation and platform guides from trusted organizations including Anthropic and OpenAI. These links are used neutrally to support evidence-based documentation claims and do not involve remote code execution.
[PROMPT_INJECTION]: A static analysis hint regarding an instruction override in rules/harness-engineering.md was reviewed and confirmed to be a false positive. The flagged text is part of a security test oracle that defines how the agent must ignore adversarial instructions in external content, thereby improving the skill's overall resilience to injection attacks.

docs-maker