The Agent Skills Directory

[PROMPT_INJECTION]: The protocol defines how the main agent should construct prompts for subagents by incorporating findings from repository searches and web documentation. This creates a surface for indirect prompt injection where adversarial instructions embedded in repo files could influence subagent behavior. The skill includes a reporting contract but fails to instruct the agent to use cryptographic delimiters or sanitization for the untrusted data being interpolated into delegation prompts.\n
Ingestion points: Local repository files and external documentation fetched via search or grep tools during the delegation process.\n
Boundary markers: Absent; the protocol does not specify the use of unique delimiters (e.g., random string markers or specific XML tags) to isolate data from instructions in subagent prompts.\n
Capability inventory: Delegated agents have the ability to read/grep files, perform mechanical edits (file writes) across multiple files, and perform web lookups.\n
Sanitization: No validation or sanitization requirements are defined for external or repository content before it is processed by subagents.

delegation-protocol