The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructions direct the agent to utilize vocabulary from CONTEXT.md and mappings from CONTEXT-MAP.md found within the user's repository.
Ingestion points: Content is read from CONTEXT.md and potentially other files specified in CONTEXT-MAP.md (identified in SKILL.md).
Boundary markers: There are no explicit delimiters or instructions to the agent to disregard potential commands embedded within these vocabulary files.
Capability inventory: The skill explicitly sets disable-model-invocation: true in the frontmatter, which restricts the agent from invoking additional tools or models, thereby limiting the impact of any potential injection.
Sanitization: The skill does not implement any validation or filtering for the content ingested from the external repository files.

do-huh