The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and audit external data (source code, documentation, and diffs) based on a user-provided scope. This ingestion process creates a surface for indirect prompt injection if the audited files contain adversarial instructions intended to subvert the agent's behavior during the audit or fix process.
Ingestion points: The agent reads file content and directory structures across a repository defined by the <scope> placeholder in the instructions and search commands (found in SKILL.md and references/recall-batteries.md).
Boundary markers: The skill does not provide specific instructions to wrap external content in delimiters or include 'ignore embedded instructions' warnings, increasing the risk that the agent might inadvertently obey instructions found within the files it is auditing.
Capability inventory: The skill utilizes file-reading capabilities (via ripgrep) and file-writing capabilities (authorized for 'fixing' prose), providing a path for injected instructions to influence both the output and the repository state.
Sanitization: The instructions do not include steps for sanitizing, escaping, or validating the ingested content before processing, relying on the agent's internal reasoning to distinguish between data and instructions.

trim-reasoning-leakage