The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructions specify that the agent should "Inspect any brief, notes, product or repository already supplied before asking questions." This identifies a data ingestion surface where the agent processes untrusted external content. However, because the skill has no dangerous capabilities (no file system writes, no network exfiltration, and no code execution tools), the risk is negligible. No specific boundary markers or sanitization logic is provided in the instructions for this data ingestion step.
[SAFE]: The skill is composed entirely of natural language instructions and evaluation cases. It does not include Python or Node.js scripts, external package dependencies, or remote code patterns. All file references (e.g., user-profile.md and other skill paths) are local to the repository structure and used for context or routing logic.

idea-refinement