The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: the skill ingest content from multiple untrusted sources within the repository that could contain malicious instructions.
Ingestion points: SKILL.md (Step 1) and references/claude-skill.md (Steps 0, 1, 1b, 3, 4) read repository-local instructions (AGENTS.md, CLAUDE.md), workflow catalogs (workflow-catalog.yaml), and metadata from other installed skills (.claude/skills/*/SKILL.md).
Boundary markers: The instructions lack boundary markers or explicit directives for the agent to ignore any natural language instructions embedded within the files it reads.
Capability inventory: The skill environment grants access to Read, Glob, and Grep tools. The SKILL.md workflow also suggests that for implementation tasks, the agent may "make the change directly" (file-write capability).
Sanitization: No evidence of sanitization, filtering, or validation is provided for data extracted from file headers or descriptions before it is presented to the user or used to influence the next suggested action.

help