The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructions direct the agent to ingest and use information from local files (CONTEXT.md and CONTEXT-MAP.md) to re-pitch messages. If these external files contain malicious instructions, the agent could be manipulated into deviating from its intended task.
Ingestion points: The skill explicitly reads from CONTEXT.md and CONTEXT-MAP.md located within the repository.
Boundary markers: Absent. The instructions do not specify delimiters or provide warnings to the agent to ignore any potential instructions found within the context files.
Capability inventory: The skill itself is restricted via disable-model-invocation: true and contains no code, shell commands, or network operations.
Sanitization: Absent. There is no evidence of filtering or validation of the content retrieved from the context files.

wait-what