The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is instructed to run validation commands sourced from an external file (.agents/workflow.md) and the 'hook context'. This creates a surface for indirect prompt injection where an attacker could place malicious commands in these files to be executed by the agent.
Ingestion points: Commands are read from .agents/workflow.md and the session hook context.
Boundary markers: No explicit delimiters or instructions are provided to the agent to treat this external content as untrusted or to ignore embedded directives.
Capability inventory: The skill possesses the capability to execute shell commands (e.g., repository-native commands, bd tool invocations).
Sanitization: There is no evidence of sanitization, validation, or human-in-the-loop confirmation before the commands retrieved from the file are executed.
[COMMAND_EXECUTION]: The workflow involves executing various repository-native and validation commands. While intended for setup verification, this capability is the primary mechanism through which the indirect injection vulnerability would be realized.

flow-setup