The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates the delegation of tasks to child agents by passing user-provided instructions verbatim into the worker's prompt context. This interpolation of untrusted data creates a surface for indirect prompt injection where malicious instructions in the user intent could attempt to subvert the behavior or constraints of worker agents.
Ingestion points: The skill ingests raw user content in SKILL.md (Step 3: Delegate with an envelope) and reference.md (Delegation envelope section), where it is stored in the User's words: "<verbatim>" field.
Boundary markers: The delegation templates in SKILL.md and reference.md use markdown structure for the brief but do not include explicit escaping, sanitization, or instructions for workers to ignore embedded commands within the verbatim section.
Capability inventory: Child worker sessions are granted significant capabilities described in SKILL.md, including branch and PR management, CI execution, release deployment, and the use of APIs for autonomous implementation.
Sanitization: The instructions explicitly require passing user words "verbatim" and do not provide mechanisms for filtering or sanitizing this data before it reaches the child agents.

autonomous-delivery