The Agent Skills Directory

[PROMPT_INJECTION]: The skill defines an architecture for ingesting untrusted external data (articles, papers, transcripts), which introduces a surface for indirect prompt injection.
Ingestion points: Content is read from the raw/ directory as described in SKILL.md (Phase 2).
Boundary markers: Absent; the documentation does not specify delimiters to separate untrusted content from agent instructions.
Capability inventory: The skill has capabilities to read/write files and execute git mv as documented in SKILL.md phases 1 through 5.
Sanitization: Absent; no mention of filtering or sanitizing external content before processing.
[COMMAND_EXECUTION]: The scripts/validate.sh file contains shell commands for internal structural validation.
Evidence: Uses grep, head, and bash -c to check for specific strings within the skill's own SKILL.md file. These operations are static, perform read-only checks on project metadata, and are restricted to the skill's directory.

llm-wiki