The Agent Skills Directory

[SAFE]: The skill defines a multi-agent orchestration pattern for exploring codebase architecture. All subagents (explorers, explainers, and critics) are explicitly configured with readonly: true in SKILL.md. This platform-level constraint ensures that subagents cannot modify the filesystem, install external software, or execute state-changing operations, effectively maintaining the principle of least privilege.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted source code from the target repository, creating a potential surface for indirect prompt injection. However, the risk is classified as safe due to the read-only environment and the lack of network exfiltration tools available to the subagents.
Ingestion points: Subagents read codebase files using Glob, Grep, and Read tools as instructed in references/explorer-prompt.md.
Boundary markers: The prompt templates do not include specific delimiters or instructions to ignore embedded prompts within the source code files.
Capability inventory: Subagents are restricted to internal read-only tools and have no access to arbitrary shell execution or network communication.
Sanitization: No sanitization of code content is performed.
[SAFE]: No suspicious URLs, hardcoded credentials, or persistence mechanisms were found. The skill's structure and model references are consistent with its stated purpose of architectural understanding.

how