The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from multiple external and internal sources, which could contain malicious instructions intended to influence the agent's behavior during context reconstruction.
Ingestion points: The skill reads conversation history via t3_thread_read and t3_thread_search, and pulls data from 'shared records' including issue trackers, source control metadata, and error tracking systems (referenced as being performed by the why skill).
Boundary markers: The instructions do not specify the use of clear delimiters or 'ignore embedded instructions' warnings when processing the content of these threads or external reports.
Capability inventory: The skill utilizes delegate_task to spawn subagents, interacts with git and gh (GitHub CLI) for state verification, and uses t3_worktree_list to inspect the file system.
Sanitization: The skill contains a prompt-level instruction to 'sanitize private context before any public output,' but lacks technical sanitization or validation logic to filter potentially malicious content from the ingested data streams.

recall