The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill interacts with external web applications which are untrusted data sources. Because the agent possesses the ability to write to files and execute shell commands, it is susceptible to instructions hidden within the target website's HTML, metadata, or console logs.
Ingestion points: External web content visited during the 'Explore' phase via the browser tool (SKILL.md).
Boundary markers: There are no specific instructions or delimiters provided to the agent to treat web content as data only or to ignore embedded instructions.
Capability inventory: The skill utilizes Bash, Write, Edit, and git tools, providing a significant impact if an injection is successful.
Sanitization: No sanitization or validation of the ingested web content is mentioned before the agent acts upon its observations.
[COMMAND_EXECUTION]: The skill executes local shell commands and scripts to manage the environment and version control.
Evidence: It calls a shell script at $CLAUDE_PLUGIN_ROOT/scripts/clean-tree-check.sh and uses git commands (diff, log, add, commit, revert) for its workflow.

qa