The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes arbitrary source code which creates a surface for indirect prompt injection.
Ingestion points: changed_files (identified in Step 1 and read in Step 2).
Boundary markers: The dispatch payload uses explicit --- LABEL --- fences (e.g., --- CHANGED FILES ---) to isolate the untrusted code from instructions.
Capability inventory: The skill can modify files using Edit, perform repository operations via Bash (git), and track progress via TodoWrite.
Sanitization: The system relies on structured JSON output from the subagent, which is parsed and validated against a schema before any edits are applied.
[COMMAND_EXECUTION]: The skill requests Bash access but restricts it to a specific subset of git commands (git diff, git status, git checkout). These tools are used for legitimate purposes like identifying modified files and reverting changes if safety rails are tripped (e.g., if a file's YAML frontmatter is corrupted).
[EXTERNAL_DOWNLOADS]: No external downloads or network operations are detected. The skill operates exclusively on the local working tree and git history.

tidy