The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from repository content, search results, and transcripts, which presents a surface for indirect prompt injection.
Ingestion points: Data enters the context through the output of entire search and entire explain commands in SKILL.md.
Boundary markers: The skill includes strong instructions to treat all repository content, command output, and search results as untrusted data, specifically warning not to follow instructions found within them.
Capability inventory: The skill utilizes shell command execution for searching and explaining task history.
Sanitization: The instructions mandate shell-quoting user arguments and explicitly require stripping or escaping dangerous characters like backticks, semicolons, and subshell syntax before command execution.
[COMMAND_EXECUTION]: The skill constructs and executes shell commands incorporating user-supplied task descriptions.
The instructions provide a clear mitigation strategy by requiring the agent to escape and quote strings, preventing user-controlled text from being interpreted as shell commands.

recall