The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements a procedure that requires the agent to read and process a wide variety of project-specific files (e.g., README, CHANGELOG, TODO, and control files). These files are untrusted external inputs that could be manipulated to include malicious instructions that influence the agent's optimization plan or actions.
Ingestion points: In Step A of the protocol (defined in SKILL.md and language-specific READMEs), the agent is instructed to "Read all root documents completely" and "Read all markdown and control files in the project folder."
Boundary markers: Absent. The instructions do not provide specific delimiters or guidance to distinguish between the protocol's instructions and untrusted data within project files.
Capability inventory: The agent has capabilities for reading files (Read(./**)), editing files (Edit(./**)), and executing specific shell commands (git, pytest, cookiecutter) as suggested in the references/optimal-project-structure.md configuration examples.
Sanitization: Absent. The skill does not specify any methods for sanitizing or validating the content of the processed project files.
[COMMAND_EXECUTION]: The skill encourages the agent to use project-specific tooling and shell commands (such as git, pytest, cookiecutter, and uv) to perform optimization and testing (Steps D, E, and F). While these are standard developer tools, they represent an execution capability that could be targeted if the agent is influenced by indirect prompt injection.

pipeline-optimizer