The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external codebase data, which creates a potential surface for indirect prompt injection where malicious content in files could attempt to influence the agent's explanations.
Ingestion points: Codebase findings are gathered by explorers and interpolated into the explainer's context via the {EXPLORER_FINDINGS_ALL} placeholder in references/explainer-prompt.md.
Boundary markers: The templates use Markdown structure (headers and blockquotes) to separate untrusted findings from instructions, though no specific 'ignore instructions' delimiters are applied to the raw code data.
Capability inventory: The subagents utilize Read, Grep, and Glob tools as specified in references/explainer-prompt.md.
Sanitization: No explicit sanitization or filtering of the codebase content is performed before synthesis.
Mitigation: A critical security control is implemented in SKILL.md, which mandates readonly: true for every spawned subagent, preventing any file modifications or state changes prompted by malicious code comments.

how