The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill operates by ingesting and synthesizing large volumes of untrusted data from diverse external sources, creating a high-exposure surface for indirect prompt injection attacks.
Ingestion points: Data is pulled from external platforms including GitHub PRs and review comments (references/sources/code-archaeology.md), Linear tickets and comments (references/sources/linear.md), Notion documents and specs (references/sources/notion.md), Slack conversation threads (references/sources/slack.md), and Sentry error logs and stack traces (references/sources/sentry.md).
Boundary markers: While the references/investigator-prompt.md and references/synthesizer-prompt.md templates use markdown headers to structure the prompt, they lack robust boundary markers or specific instructions to the agent to disregard instructions found within the fetched data.
Capability inventory: The skill utilizes powerful tools for filesystem interrogation (git, rg) and network-connected services via MCP (Slack, Datadog, Databricks). The investigator and synthesizer subagents are explicitly granted tool access (readonly: false) to perform their tasks, increasing the potential impact of a successful injection.
Sanitization: No sanitization, escaping, or filtering of content from external APIs or local git logs is implemented before the data is passed into the subagent context.

why