The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process text from a wide variety of untrusted external sources, including pull request comments, Slack message history, Notion documents, and issue tracker descriptions. This content is interpolated into subagent prompts without explicit sanitization, creating a surface for indirect prompt injection attacks where malicious instructions hidden in the data could influence agent behavior.
Ingestion points: Content is pulled from git log, gh pr view, and multiple MCP tools (Slack, Notion, Linear, Datadog, Sentry, Databricks) into the context of the investigator and synthesizer subagents.
Boundary markers: The skill uses template prompts (e.g., references/investigator-prompt.md) to structure subagent tasks, but does not implement robust delimiters or instructions to ignore commands embedded in the retrieved data.
Capability inventory: The agent and its subagents have the ability to execute shell commands (git, gh) and invoke MCP tools that access sensitive organizational telemetry and documentation.
Sanitization: There is no evidence of filtering or escaping logic for the external content before it is processed by the LLM subagents.
[COMMAND_EXECUTION]: The skill relies on executing local shell commands to establish a "Code Anchor."
Evidence: The skill uses git blame, git log, and gh pr view to extract commit history, PR numbers, and discussion threads from the local environment and GitHub.

why