The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it processes and summarizes untrusted project data.
Ingestion points: The workflow in SKILL.md (Step 4) specifies that the agent reads manifests, existing documentation, tree structures, CI configurations, and license files from the target root.
Boundary markers: While the skill uses heading-based parsing to merge content, it lacks explicit delimiters or specific instructions to ignore malicious agent-directed instructions that might be embedded in the files being analyzed.
Capability inventory: The agent possesses file-writing capabilities (restricted to four specific documentation files) and file-reading capabilities across the project directory.
Sanitization: The instructions do not define methods for sanitizing or escaping content retrieved from external files before using it in the project model or final output.
[SAFE]: Several protective measures are built into the skill's design.
Confirmation Mechanism: The skill requires the agent to display a per-file diff and obtain explicit user confirmation before performing any write operations.
Secret Handling: SKILL.md contains a specific safety rule forbidding the embedding of secrets found in .env files, credentials, or local configurations.
Defined Scope: The skill explicitly limits its modifications to README.md, README.ko.md, ARCHITECTURE.md, and USAGE.md, refusing to edit source code or unrelated files.

gen-docs