The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill serves as a management system for custom instructions stored within project markdown files (e.g., docs/project-prompts/<slug>.md). This creates a vulnerability surface where malicious instructions could be introduced via project data (such as a Pull Request) and subsequently executed by the agent.
Ingestion points: Files located in docs/project-prompts/ and the custom-prompts-reference.md index file.
Boundary markers: The skill requires a mandatory confirmation gate using the ask user question tool during matching, saving, and updating (Phases 2 and 4).
Capability inventory: The skill executes imperative steps directly or routes them to other skills and workflows, including file system writes to the docs/ directory.
Sanitization: The skill includes explicit instructions to validate frontmatter and refuse any commands within a prompt body that attempt to waive safety policies, git discipline, or active route policies.
[DYNAMIC_EXECUTION]: In Phase 3 (RUN), the skill dynamically loads and executes protocols from local files at runtime. While these files are intended to be user-authored, the agent is interpreting and executing logic that is not statically defined in the skill's own instructions.
[COMMAND_EXECUTION]: The skill is designed to execute 'imperative and observable steps' defined in the custom prompt bodies. This involves the agent performing actions like running tests, writing files, or interacting with other tools based on the instructions stored in the project repository.

custom-prompt