The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and display content from multiple user-controlled files, which serves as a potential vector for indirect prompt injection attacks.
Ingestion points: The skill reads content from several project locations including context/handoffs/*.md (Stop 2), .claude/memory/MEMORY.md (Stop 3), .claude/rules/*.md (Stop 4), knowledge/concepts/*.md (Stop 5), and projects/*/README.md (Stop 7).
Boundary markers: The instructions advise the agent to "Show the first 5-10 lines so user sees the format, not the content," which acts as a limited display buffer but does not constitute a formal security boundary or a warning to ignore instructions contained within the files.
Capability inventory: The skill is limited to read-only capabilities using Read, Glob, and Grep tools as defined in the frontmatter.
Sanitization: There is no evidence of content sanitization, escaping, or validation performed on the data read from the local files before it is processed or displayed in the conversation context.

tour