The Agent Skills Directory

[COMMAND_EXECUTION]: The skill performs local shell operations using git blame, git log, and the GitHub CLI (gh pr view) to establish a code anchor and retrieve historical metadata from the repository.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its architecture of ingesting and processing untrusted data from multiple external sources.
Ingestion points: Data is pulled from MCP-connected services including Slack, Notion, Linear, Sentry, Datadog, and Databricks (found in SKILL.md and references/source-playbook.md).
Boundary markers: There are no explicit delimiters or specific instructions for subagents to ignore potentially malicious instructions embedded in external chat messages, PR comments, or ticket descriptions.
Capability inventory: Subagents are granted tool-use capabilities (readonly: false) and the main agent has shell command access.
Sanitization: There is no evidence of filtering or escaping logic applied to the external content before it is processed by the LLM subagents.
[SAFE]: The skill's access to sensitive organizational data (infrastructure metrics, team chat, design documents) is strictly aligned with its primary purpose as an archaeology and research tool. The prompts in references/epistemics.md and references/synthesizer-prompt.md enforce high standards for evidence-based reasoning, citation verification, and the preservation of uncertainty, which serve as functional guardrails against confident storytelling or rationalization.

why