The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data during its context exploration phase.
Ingestion points: SKILL.md (Step 1: Explore project context) reads files, documentation, and recent commits.
Boundary markers: Absent; the skill does not use specific delimiters or instructions to ignore embedded prompts in external data.
Capability inventory: Writing files to the repository, committing changes via git, and executing shell commands.
Sanitization: No sanitization or filtering of external project content is specified.
[COMMAND_EXECUTION]: The debugging reference file suggests shell commands for the agent to execute.
Evidence: references/debugging-principles.md includes commands such as env | grep IDENTITY, security list-keychains, and ./find-polluter.sh.
[DATA_EXFILTRATION]: The skill provides instructions to access sensitive system information, which constitutes potential data exposure.
Evidence: The commands security list-keychains (which exposes macOS keychain paths) and env | grep IDENTITY (which can expose signing identities or related environment variables) are listed as diagnostic tools in references/debugging-principles.md.

brainstorming