The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and audit untrusted external data, specifically Markdown documentation, session logs, and workflow guides within a repository.
Ingestion points: The context-auditor, handoff-checker, and workflow-validator agents use Glob, Read, and Grep tools to discover and process all documentation files, including README.md, SESSION.md, and files in the docs/ directory.
Boundary markers: There are no explicit boundary markers or instructions to treat the audited content as potentially untrusted data. The agents are instructed to follow the content literally to check for executability.
Capability inventory: The workflow-validator agent is granted the Bash tool and instructions to "actually trace through" documented workflows, which may involve executing shell commands found in the files.
Sanitization: The skill lacks sanitization or filtering logic for the content it reads before processing it through the LLM.
[COMMAND_EXECUTION]: The workflow-validator agent utilizes the Bash tool to verify that documented processes (such as build or deployment steps) are executable. While the examples provided in the documentation refer to standard tools like npm and Cloudflare's wrangler, this capability could be exploited if an attacker places malicious commands in project documentation that the agent then attempts to verify by execution.

project-health