The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill reads the first 15 lines of untrusted CONTEXT-*-llm.md files to extract metadata fields like focus and goal.
Ingestion points: Phase 2 reads content from files across the code/, projects/, repos/, and vaults/ directories.
Boundary markers: No explicit boundary markers or 'ignore' instructions are used when reading these files.
Capability inventory: The skill possesses Bash, Edit, and Write tools, which could be misused if a malicious file successfully injects instructions.
Sanitization: There is no evidence of sanitization or escaping of the extracted text before it is displayed to the user or written to INDEX.md.

list-contexts