The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill synthesizes documentation by ingesting data from external sources such as the project codebase, alignment documents, and architecture decision records.
Ingestion points: The agent is instructed in SKILL.md to read content from docs/monorail/, ADRs, and the wider codebase using tools like grep and read during its grounding and synthesis phases.
Boundary markers: The instructions do not define clear delimiters or specific instructions for the agent to treat content read from the codebase as data rather than instructions.
Capability inventory: According to SKILL.md, the skill performs file system operations (read/write), shell commands (ls, grep), and has the ability to spawn read-only sub-agents to explore the codebase.
Sanitization: There is no evidence of content sanitization or validation to prevent instructions embedded in codebase files from being interpreted by the agent during the synthesis of spec.md.

rail-spec