The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data from external repository files, which can influence its behavior and orchestration logic.
Ingestion points: The workflow specifically instructs the agent to read AGENTS.md, CLAUDE.md, production/review-mode.txt, .claude/docs/technical-preferences.md, and other path-scoped project documents to determine its behavior and configuration (e.g., review modes, technical preferences).
Boundary markers: The instructions lack explicit boundary markers or XML-style delimiters to separate the skill's core logic from the content of the ingested files, increasing the risk that instructions inside those files could be interpreted as system-level commands.
Capability inventory: The agent has access to a powerful toolset including Bash, Write, Edit, and Task (sub-agent spawning), which provides a significant impact vector if the agent is manipulated by instructions embedded in the repo-local files.
Sanitization: There are no defined sanitization, filtering, or validation steps for the content read from the repository files before it is used to guide the orchestration process.

team-combat