The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the target codebase (read by architecture-cartographer.md) and an optional user-supplied REFERENCE_URL (fetched by reference-assessor.md). It mitigates potential injection risks by instructing subagents to treat all external content as data rather than instructions and to isolate reference findings in a QuarantineHold state until a formal EvidencePrecedence decision is made. Any detected directives in the data must be quoted in a Security notes section rather than followed.
[EXTERNAL_DOWNLOADS]: The skill fetches content from a user-provided REFERENCE_URL and a set of reputable architectural reference sites listed in references/external-sources.md (e.g., martinfowler.com, owasp.org, blog.cleancoder.com). These fetches are strictly limited to background research and are subject to the skill's data-not-instructions policy.
[COMMAND_EXECUTION]: The skill utilizes read-only version control commands like git log, git status, and git show to analyze the codebase structure and history. It explicitly forbids commands that modify the target tree, such as builds, installs, or refactors, ensuring a read-only analysis environment.
[PROMPT_INJECTION]: A static analysis flag regarding instruction overrides was determined to be a false positive. The instructions in subagents/reference-assessor.md telling the agent to 'ignore previous instructions' found in external content are defensive measures designed to protect the agent from third-party prompt injection, not attempts to subvert the agent's own system prompt.

planning-codebase-restructuring