The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it analyzes and synthesizes information from arbitrary files within a codebase, which could contain malicious instructions.
Ingestion points: The explorer subagents ingest codebase content using the Read, Grep, and Glob tools as defined in references/explorer-prompt.md. The explainer subagent then processes these synthesized findings as defined in references/explainer-prompt.md.
Boundary markers: The templates in references/explorer-prompt.md and references/explainer-prompt.md use markdown headers to delineate sections, but they lack specific delimiters or instructions to ignore potential commands embedded within the code being analyzed.
Capability inventory: The skill spawns subagents (via Task, Agent, task, or spawn_agent tools) with readonly: true as specified in SKILL.md. This limits the subagents to read-only access, preventing them from modifying the system, but allows them to be influenced by content they process.
Sanitization: No explicit sanitization, filtering, or escaping of the content read from the workspace is performed before it is presented to the LLM subagents.

how