The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process large volumes of potentially untrusted data from multiple external sources, creating a significant attack surface.
Ingestion points: The skill reads data from git history, PR descriptions and comments, Linear/Jira tickets, Notion/Confluence documents, Slack/Discord conversations, Datadog/Splunk telemetry, and Sentry error logs as detailed in 'SKILL.md' and its reference files.
Boundary markers: The skill relies on an 'Epistemics Framework' (references/epistemics.md) and specific sub-agent instructions (references/investigator-prompt.md) to maintain objective analysis, but it lacks explicit technical delimiters (e.g., XML tags or specific 'ignore instructions' wrappers) to isolate untrusted content during processing.
Capability inventory: The skill possesses extensive read-only access to organizational data across many platforms via Model Context Protocol (MCP) tools, such as 'execute_sql_read_only' (references/sources/databricks.md) and various 'search' tools for Slack, Sentry, and Datadog. 'SKILL.md' explicitly states that 'Investigators still shouldn't write anything,' which limits the potential impact of an injection.
Sanitization: No explicit sanitization, filtering, or validation of content retrieved from external sources is described in the provided instruction set.

why