The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted content from various external platforms, creating a surface for indirect prompt injection attacks.
Ingestion points: Untrusted data enters the agent's context through gh pr view (GitHub PR bodies), get_issue (Linear tickets), notion-fetch (Notion docs), Slack threads, and Datadog logs as defined in the source playbooks in references/sources/.
Boundary markers: The prompt templates in references/investigator-prompt.md and references/synthesizer-prompt.md use markdown headers and blockquotes but lack specific instructions or robust delimiters to prevent the agent from following commands embedded within the fetched content.
Capability inventory: The skill possesses significant capabilities, including git and gh execution, and the ability to spawn sub-agents with readonly: false permissions (agent mode) to utilize MCP tools.
Sanitization: The instructions do not include any steps for sanitizing, escaping, or validating the data retrieved from external sources before it is processed by the AI models.

why