The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data by scanning and reading various files within a repository, including documentation, configuration files, and scripts. This creates a surface where malicious instructions embedded in a target repository could attempt to influence the agent's behavior.
Ingestion points: Files scanned in SKILL.md Step 2, including root docs, instructions, package/build/test config, CI, scripts, and skill/workflow docs.
Boundary markers: The instructions do not define explicit delimiters or 'ignore embedded instructions' markers when reading these files.
Capability inventory: The skill is designed for local analysis; the logic focuses on file reading and git history inspection. No file-write, network, or arbitrary command execution capabilities are defined in the default workflow.
Sanitization: There is no mention of sanitizing or escaping the content of the audited files before processing.
[EXTERNAL_DOWNLOADS]: The skill references several external resources in references/source-literature.md to ground its reasoning model.
Evidence: References to dora.dev for delivery metrics, google.github.io for engineering practices, and docs.github.com for pull request documentation. These are well-known, trusted industry sources.

krt-repo-medic