The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill defines a workflow that interpolates untrusted data (user questions and findings from code exploration) into subagent prompts without using explicit boundary markers or sanitization. Ingestion points: User-provided questions are inserted into {QUESTION} placeholders in references/explainer-prompt.md and references/explorer-prompt.md. Findings from explorer subagents (which may include content from the codebase) are inserted into {EXPLORER_FINDINGS_ALL}. Boundary markers: Absent. The templates do not use delimiters or specific instructions to the subagents to ignore potentially malicious instructions embedded within the interpolated text. Capability inventory: The subagents are explicitly restricted to readonly: true and utilize Read, Grep, and Glob tools. They do not have file-write or network access capabilities. Sanitization: There is no evidence of input validation or escaping for the data being processed.

how