The Agent Skills Directory

[PROMPT_INJECTION]: Static analysis flagged several phrases related to overriding instructions in standards/threat-model.md and standards/reader-contract.md. These are confirmed as false positives. The text (e.g., "ignore previous instructions") is used within technical documentation to define the threat model and specify patterns that the skill's defense mechanism is designed to mitigate, rather than being an attempt to hijack the agent's behavior.
[SAFE]: The skill implements a 'Reader' contract that restricts the tool surface to read-only capabilities (WebSearch, WebFetch, Read, Grep). This architectural choice ensures that even if the primary ingestion surface is compromised by an injection payload, it lacks the tools (Write, Edit, Bash, Skill) to perform malicious actions on the system.
[SAFE]: The scripts/validate_struct.py component serves as a deterministic containment boundary. It enforces strict schema validation (using additionalProperties: false), clamps string and array lengths to prevent buffer/context exhaustion, and performs a mandatory domain-allowlist check on all ingested URLs using internal security modules (permission_web).
[SAFE]: Indirect prompt injection risks are managed through a structural 'ledger containment invariant.' Untrusted text is strictly quarantined in a raw_input namespace and must pass through the validate_struct script before being promoted to clean top-level fields used by downstream processes.
Ingestion points: Web pages fetched via WebFetch, GitHub issue/PR/comment bodies, and Sonar issue messages.
Boundary markers: Explicitly defined in standards/reader-contract.md and enforced by the validate_struct script.
Capability inventory: The reader is restricted to retrieval tools (WebFetch, Read), while the writer possesses modification tools (Write, Edit, Bash).
Sanitization: All external data is validated against specific schemas (research, ci-finding, issue-body, finding) that include length limits and regex patterns.

untrusted-ingestion