The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest evidence and observations from potentially untrusted external sources such as web pages, documents, and repository files as part of its discovery workflow.
Ingestion points: The skill processes source material, web pages, issue trackers, and imported observations to identify reusable learnings (defined in SKILL.md and references/discovery-protocol.md).
Boundary markers: The references/discovery-protocol.md file contains a dedicated "Untrusted-source hard boundary" section which explicitly instructs the agent to treat all retrieved material as evidence and never as execution authority or instructions to change its goal.
Capability inventory: The skill has the capability to read project files and write durable records to the .itp/learnings/ and .itp/work/ directories, which are then used as context in subsequent sessions.
Sanitization: The skill relies on instructional guardrails rather than mechanical sanitization to prevent untrusted content from overriding agent behavior or exfiltrating data.

compound-learning