The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from the user's codebase, which represents an attack surface for indirect prompt injection.
Ingestion points: The skill performs Glob and Read operations on directories like src/**, app/**, pages/**, components/**, and lib/**, as well as package.json and README.md (SKILL.md).
Boundary markers: Instructions do not specify any boundary markers or delimiters (e.g., XML tags or triple quotes) to separate the codebase content from the instruction set.
Capability inventory: The skill possesses the Write (SKILL.md) and Bash (allowed-tools in SKILL.md) capabilities, which could be abused if the agent followed instructions embedded in the source files.
Sanitization: No sanitization or validation of the content read from the codebase is performed.

brain-storm