The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data from the project environment, creating a surface for indirect instructions to influence agent behavior.
Ingestion points: The skill reads files from the design/ and production/ directories, scans source code for TODO and FIXME comments, and ingests commit history via git log.
Boundary markers: The instructions lack specific delimiters or explicit warnings to the agent to disregard potential instructions embedded within the files or commit messages it analyzes.
Capability inventory: The skill is permitted to use Bash, Read, Glob, and Grep. These tools provide significant access to the local environment, which could be abused if the agent follows instructions found in processed data.
Sanitization: There is no evidence of sanitization or filtering to prevent natural language commands in documentation or code comments from being interpreted as instructions.

scope-check