The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input and potentially external web content, creating an inherent attack surface for indirect prompt injection.
Ingestion points: Data enters the agent context through variables such as DECISION_SUBJECT and STATED_CLAIM, as well as retrieved external content via the research_tools: web capability as defined in SKILL.md and subagents/originality-seat.md.
Boundary markers: Data is delimited using <decision_packet> tags. Additionally, every subagent (e.g., subagents/adversary-seat.md, subagents/reversibility-seat.md) includes specific instructions to treat content inside these tags as data only and to report any detected manipulation risks or imperative steering text.
Capability inventory: The orchestrator is capable of writing markdown files to the local file system at a path specified by HANDOFF_PATH, as documented in SKILL.md and state-machine.md.
Sanitization: The skill employs structural isolation and defensive prompting to prevent the model from executing instructions embedded within the processed data.

council-of-advisors