The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill defines a workflow for persisting session state to a file (referenced as {ledger-path}) and reconstructing the agent's context from this file after a session reset. This mechanism creates an indirect prompt injection surface where untrusted data encountered during a phase (such as sub-agent outputs or file content) could be written to the ledger and subsequently executed or obeyed by the agent when it resumes from that ledger.
Ingestion points: The ledger file is described in Rule 3 and the reference.md Ledger Entry Template as the primary source to "reconstruct state" and "resume a session."
Boundary markers: The skill does not define specific delimiters or instructions to ignore potential commands embedded within the ledger data during reconstruction.
Capability inventory: The skill requires the ability to write to the file system (to save the ledger) and read from it (to restore state). Although no network access is specified in this skill, the host environment using this discipline likely possesses such capabilities.
Sanitization: There are no instructions for sanitizing or validating the summaries and evidence pointers before they are stored in the ledger or processed during session resumption.

context-budget-discipline