The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied work descriptions and interpolates them into a mandate sent to another agent via the SendMessage tool. This presents a potential surface for indirect prompt injection if the work description contains malicious instructions intended for the delegate agent. However, the skill mitigates this through a highly structured template and explicit boundary definitions.
Ingestion points: User-provided [work description] via arguments (SKILL.md).
Boundary markers: The mandate template enforces strict fields like scope (including negative boundaries), owned_paths, and stop_conditions. It instructs the agent to "Never infer from the surrounding conversation, never invent."
Capability inventory: The skill is limited to the SendMessage tool as defined in the allowed-tools frontmatter.
Sanitization: The skill relies on structured data fields and explicit human-in-the-loop verification ("ask me before opening it") rather than automated sanitization of the description field.

brief