The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill builds a repo model by reading various project files such as README.md, CONCEPTS.md, and doc files, as well as recent commit history. This ingestion of untrusted data from the repository creates a surface for indirect prompt injection if those files contain malicious instructions meant to hijack the agent's logic during the interview phase.
Ingestion points: Reads repository-level documentation including STRATEGY.md, README.md, CONCEPTS.md, and files within docs/ or sibling documentation like PRODUCT.md.
Boundary markers: Absent. The instructions do not specify the use of delimiters or isolation warnings when reading and interpreting file content.
Capability inventory: The skill can write to STRATEGY.md and invoke a host-provided blocking question tool for user interaction.
Sanitization: No explicit sanitization or content filtering is described for the data read from the repository.
[SAFE]: The skill implements a conflict resolution and ownership model that prevents it from modifying sections marked as author-approved by other tools and preserves the structure of documents it does not solely own.

ce-strategy