The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process content from various untrusted external sources, which could potentially contain malicious instructions intended to influence the agent's behavior.
Ingestion points: The skill gathers data from web search results (references/agents/web-researcher.md), Slack conversations (references/agents/slack-researcher.md), issue trackers like GitHub or Linear (references/agents/issue-intelligence-analyst.md), and user-provided research files (references/user-research-artifacts.md).
Boundary markers: The instructions explicitly tell sub-agents to treat all external data as "gathered evidence" and "untrusted input," and specifically command them to ignore any content that resembles instructions or tool calls.
Capability inventory: The system has the ability to read/write local files, perform network searches, and access organizational communication tools.
Sanitization: The skill employs a multi-layered defense, including specific distilling logic for external content and a dedicated "fresh-context verifier" in Phase 3 (references/post-ideation-workflow.md) that independently validates the grounding of every idea against the original sources to ensure no hallucinated or injected claims persist.
[COMMAND_EXECUTION]: The skill uses a shell script to manage a secure temporary directory for caching and artifacts.
Evidence: references/grounding.md contains a bash script that resolves a scratch directory under /tmp/compound-engineering-<uid>. The script is written with defensive security practices, such as using umask 077 and chmod 700 to ensure the directory is private to the current user, and performing checks to prevent symlink attacks.

ce-ideate