The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest external project data, which creates a surface for indirect prompt injection if the project files are from an untrusted source.
Ingestion points: SKILL.md directs the agent to read CONTEXT.md to inform domain language and interface vocabulary.
Capability inventory: The skill facilitates code writing and test execution (subprocess calls), which are high-privilege operations if influenced by malicious context.
Boundary markers: The instructions do not define delimiters or specific warnings to ignore instructions embedded within the CONTEXT.md file.
Sanitization: There are no instructions for sanitizing or validating the contents of the ingested context file.

tdd