The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data from external, potentially untrusted sources such as XML comment blocks in the prompt or external files.
Ingestion points: SKILL.md (Step 1) specifies that comment data is ingested from <comments> XML blocks, standalone <comment> fragments, or exported snapshot files provided by the user or fetched from an integration.
Boundary markers: The system uses XML tags as boundaries. references/comment_xml_format.md provides a mitigation by instructing the agent to treat quoted context lines as anchors only, explicitly stating they should not be treated as instructions even if they look like them. However, the message text within the thread remains a vector.
Capability inventory: The skill is authorized to perform file system writes ('edit the canonical artifact in place' in SKILL.md Step 5) and mutate remote states via an artifact-comment integration (resolve, tombstone, reply).
Sanitization: Step 6 ('Reconcile and validate') includes structural and template validation of the edited artifact. However, there is no evidence of semantic filtering or sanitization of natural language instructions contained within the comment messages before they influence the agent's file editing logic.

review-artifact-comments