The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the workspace and promotes it into authoritative agent instructions, creating an attack surface for indirect prompt injection.
Ingestion points: The scripts/updateagents.ts script reads project metadata from package.json and composer.json, and extracts custom sections from existing agent files such as AGENTS.md, CLAUDE.md, and .cursorrules.
Boundary markers: When merging content into .agents/context/ files, the skill uses standard markdown headers (e.g., ### From [filename]) but lacks robust delimiters or explicit instructions to the agent to disregard any embedded commands or instructions within the merged text.
Capability inventory: The skill is granted write_to_file and bash (via spawnSync and tool configuration), which are powerful capabilities that could be targeted by a poisoned context.
Sanitization: The implementation in scripts/updateagents.ts performs basic string manipulation and template replacement but does not include any mechanism to detect or sanitize potential prompt injection patterns in the extracted workspace content.

updateagents