The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze external inputs such as repository content, issue logs, and proposals to determine the appropriate workflow route. This ingestion of untrusted external data represents an indirect prompt injection attack surface.
Ingestion points: As described in SKILL.md and references/routing.md, the skill reads repository evidence, issue descriptions, logs, and reviewer preferences.
Boundary markers: The instructions provide conceptual boundaries by telling the agent to "Respect the requested deliverable" and "Continue within authority," but do not specify technical sanitization or delimiters for the ingested data.
Capability inventory: The skill can trigger various sub-skills (triage, architect, diagnose-issue, etc.) and execute local tooling via the harness run command.
Sanitization: There are no explicit instructions for sanitizing or escaping the content retrieved from external files or issues before processing.

planning-workflow