The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the local codebase to answer architectural questions, creating a surface for indirect prompt injection.
Ingestion points: The skill instructions in references/explorer-prompt.md direct subagents to use Glob, Grep, and Read tools to ingest content from the project codebase.
Boundary markers: The templates in references/explorer-prompt.md and references/explainer-prompt.md lack explicit delimiters or instructions to the model to ignore potential natural language commands embedded within the code snippets being analyzed.
Capability inventory: The skill spawns subagents with access to Read, Grep, Glob, and Task tools. Although these subagents are configured with readonly: true to prevent modifications, they possess extensive read access to the project structure.
Sanitization: There is no evidence of filtering, escaping, or sanitizing the codebase content before it is interpolated into the prompts for the explorer or explainer agents.

how