The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits a vulnerability surface for indirect prompt injection by ingesting and processing data from external, multi-user platforms where attackers could place malicious instructions.\n
Ingestion points: Content is retrieved from source control history (via gh and git), issue trackers (e.g., Linear), long-form documentation (e.g., Notion), and real-time team chat (e.g., Slack) as described in SKILL.md Step 3 and the category playbooks.\n
Boundary markers: The prompt templates provided in references/investigator-prompt.md and references/synthesizer-prompt.md do not utilize robust delimiters or specific instructions to isolate and treat the external data as untrusted content.\n
Capability inventory: The skill orchestrates multiple subagents via delegate_task with access to a wide array of MCP tools for services like Datadog, Sentry, and Databricks. While instructions specify a 'read-only' posture for these subagents, the inherent ability to query these systems based on external inputs remains a risk factor.\n
Sanitization: There is no evidence of content filtering, escaping, or sanitization of the data retrieved from external sources before it is interpreted by the agent or its subagents.

why