The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and follow instructions from files within the target repository, which is a common mechanism for repository-level configuration but presents a surface for instructions to influence agent behavior.
Ingestion points: The skill reads AGENTS.md, CLAUDE.md, and .agents/bento/bento-refactor.md from the repository root to adapt its behavior.
Boundary markers: The skill references an external documentation path (../bento-learn/references/instruction-layer.md) for overlay rules but does not implement internal delimiters for the data it reads.
Capability inventory: The skill allows the agent to provide verified edits and suggested commit slices, but explicitly restricts high-risk actions such as committing, changing branches, invoking shipping tools, or writing to trackers.
Sanitization: No specific sanitization or validation of the ingested repository instructions is mentioned, as they are treated as authoritative configuration for the refactoring task.

bento-refactor