The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from session logs and external files to drive its verification logic, creating a surface for potential manipulation.
Ingestion points: Reads data from tracks/_meta/edit_manifest.yaml, tracks/_meta/fh_signal_*.md, knowledge/shared/learnings/subagent_invocations_log.yaml, and git log outputs to verify predictions.
Boundary markers: None identified. The skill relies on simple grep and YAML parsing without explicit delimiters to separate instructions from log content.
Capability inventory: The skill has Write, Edit, and Bash capabilities, which are used to modify the manifest and repository files based on the results of its data analysis.
Sanitization: There is no evidence of sanitization, validation, or escaping of the content retrieved from logs or session utterances before it influences the gate_decision (accepted/rejected) or match_score logic.

edit-manifest