The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests various files from the repository that could potentially contain malicious instructions, such as bug reports, user stories, and test execution results (NUnit XML).
Ingestion points: Processes repository-local instructions (AGENTS.md, CLAUDE.md), project documentation, and external test result files as described in SKILL.md and references/claude-skill.md.
Boundary markers: The workflow lacks explicit instructions to treat ingested data as untrusted or to use specific delimiters to separate data from instructions.
Capability inventory: The skill is configured to use Read, Glob, Grep, and Write tools, and SKILL.md explicitly allows it to perform implementation tasks and code changes directly in the repository.
Sanitization: There is no evidence of input validation, escaping, or sanitization before external content is incorporated into the agent's context.

regression-suite