The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill provides a surface for indirect prompt injection by instructing the agent to scan session history—which may contain untrusted data or previous adversarial inputs—and transform that data into durable changes in the repository.
Ingestion points: The entire session history, including product owner preferences and codebase knowledge, is scanned in SKILL.md.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to treat input data as untrusted or to ignore embedded instructions within that data.
Capability inventory: The skill utilizes file-writing capabilities to modify various repository files, including configuration files like .oxlintrc.json, executable script logic in index.mjs, and other instructions in SKILL.md or AGENTS.md.
Sanitization: No sanitization or validation logic is specified before the agent writes the extracted session data into the repository's permanent structure.

reflect