The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from project files and pull request templates, creating a surface for indirect prompt injection.
Ingestion points: The skill reads project configuration files (CLAUDE.md, AGENTS.md) to set the agent's persona and style based on an internal reference file. It also reads repository-specific PULL_REQUEST_TEMPLATE.md files to initialize pull request descriptions.
Boundary markers: The instructions include a general rule to treat instructions in untrusted documents as data, which is a positive security measure. However, they do not define explicit structural delimiters to isolate this data within the agent's context when it is read and incorporated into the workflow.
Capability inventory: The skill possesses capabilities to execute local bash scripts (open-pr.sh, text-frame.sh), perform git operations (including pushing to remotes), and use the GitHub CLI to create or edit pull requests. It can also automate browser interactions via the orca tool if present.
Sanitization: Scripts such as text-frame.sh perform XML escaping for SVG generation to prevent injection into visual logs. However, the agent's primary workflow for reading project files lacks specific input validation or sanitization to filter out malicious natural language instructions that might be embedded in the markdown files.

reveal