The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill operates by ingesting and processing untrusted data from GitHub issues and user-provided feature descriptions, which could contain malicious instructions.
Ingestion points: Untrusted external data enters the agent context through files such as issue-body.txt and feature-description.txt during the initial setup and plan drafting phases (SKILL.md).
Boundary markers: To protect against instruction leakage, the skill utilizes XML delimiters (e.g., <reviewer_feature_description> and <reviewer_plan>) and explicit instructions for sub-agents to treat encapsulated content as data rather than executable instructions (references/plan-review-runtime.md).
Capability inventory: The skill possesses high-privilege capabilities including arbitrary shell command execution via the Bash tool, file system modification using Write and Edit, and the ability to spawn sub-tasks and sub-agents (SKILL.md, references/dialectic-clarifier.md).
Sanitization: The skill architecture includes automated secret redaction and mechanical backstops for sanitizing artifacts before they are published back to external services like GitHub (references/finalize-step5.md).

design