The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and explain data from external or untrusted sources (source code, git logs, pull requests, and web content), which presents a surface for indirect prompt injection attacks where malicious content in the data could attempt to hijack the agent's logic.\n
Ingestion points: Untrusted data is retrieved via git log, gh CLI, and web research tools as described in references/orchestration.md and references/agents/work-recap-scout.md.\n
Boundary markers: The skill provides detailed rendering requirements in references/explainer-html.md and references/explainer-markdown.md that effectively neutralize many injection payloads by prohibiting scripts and external resource requests in the output. However, there are no explicit instructions to the agent to disregard instructions found within the ingested data during processing.\n
Capability inventory: The skill possesses the ability to execute shell commands (mkdir, chmod, cp), dispatch subagents with specific briefs, and potentially access network resources through web tools.\n
Sanitization: The instructions do not specify any sanitization or escaping of the external content before it is processed or summarized.\n- [COMMAND_EXECUTION]: The skill explicitly uses shell commands for environmental setup and file management.\n
Evidence: SKILL.md includes a shell script designed to create a secure, private temporary directory using commands like id -u, mkdir, chmod, date, and openssl. This script implements defensive checks for symlinks and directory ownership.\n
Evidence: references/destinations.md uses the cp command to transfer generated explanation artifacts from temporary storage to permanent locations requested by the user.

ce-explain