The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from repository files, git diffs, and external worker briefs, creating a surface for indirect prompt injection.
Ingestion points: The skill instructions in SKILL.md direct the agent to read repository code, git history, and the "Worker Brief" provided in the chat context.
Boundary markers: While the skill references an "inline execution context," it lacks explicit instructions to delimit or ignore instructions embedded within the processed code or briefs.
Capability inventory: The skill possesses file system write access (creating folders and writing files) and command execution capabilities (running terminal commands for evidence gathering).
Sanitization: There are no explicit requirements for sanitizing or escaping the content read from the repository or brief before it is processed by the agent.

implement