The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements a self-learning mechanism that reads from .wfgy/lessons.md at the start of every task. If this file contains malicious instructions (e.g., from a compromised or malicious repository), the agent may incorporate them into its reasoning context.
Ingestion points: The agent is instructed to read the project-local .wfgy/lessons.md file in both SKILL.md and references/lessons-template.md.
Boundary markers: The instructions do not provide boundary markers or specific guidance to treat the content of the lessons file as potentially untrusted data.
Capability inventory: As a coding agent skill, the agent typically possesses capabilities for file system modification and terminal execution, which increase the potential impact of following instructions embedded in the lessons file.
Sanitization: There is no mechanism described for sanitizing or validating the content read from the lessons file before it is used to guide the agent's work.

wfgy-method